theory Untyped_R

lemma resetUntypedCap_corres:
  "untypinv_relation ui ui'
    \<Longrightarrow> corres (dc \<oplus> dc)
    (invs and valid_untyped_inv_wcap ui
      (Some (cap.UntypedCap dev ptr sz idx))
         and ct_active and einvs
         and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.Retype slot True
             ptr_base ptr' ty us slots dev))
     (invs' and valid_untyped_inv_wcap' ui' (Some (UntypedCap dev ptr sz idx)) and ct_active')
     (reset_untyped_cap slot)
     (resetUntypedCap (cte_map slot))" apply (rule corres_gen_asm, clarsimp) apply (simp add: reset_untyped_cap_def resetUntypedCap_def
                   liftE_bindE) apply (rule corres_guard_imp) apply (rule corres_split[OF getSlotCap_corres]) apply simp apply (rule_tac F="cap = cap.UntypedCap dev ptr sz idx
              \<and> (\<exists>s. s \<turnstile> cap)" in corres_gen_asm) apply (clarsimp simp: bits_of_def free_index_of_def unlessE_def
                 split del: if_split) apply (rule corres_if[OF refl]) apply (rule corres_returnOk[where P=\<top> and P'=\<top>], simp) apply (simp add: liftE_bindE bits_of_def split del: if_split) apply (rule corres_split) apply (rule deleteObjects_corres) apply (clarsimp simp: valid_cap_def cap_aligned_def) apply (clarsimp simp: valid_cap_def cap_aligned_def untyped_min_bits_def) apply (rule corres_if) apply simp apply (simp add: bits_of_def shiftL_nat) apply (rule corres_split_nor) apply (simp add: unless_def) apply (rule corres_when, simp) apply (rule corres_machine_op) apply (rule corres_Id, simp, simp, wp) apply (rule updateFreeIndex_corres, simp) apply (simp add: free_index_of_def) apply (wp | simp only: unless_def)+ apply (rule_tac F="sz < word_bits \<and> idx \<le> 2 ^ sz
                 \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz
                 \<and> resetChunkBits \<le> sz" in corres_gen_asm) apply (simp add: bits_of_def free_index_of_def mapME_x_map_simp liftE_bindE
                         reset_addrs_same[where ptr=ptr and idx=idx and sz=sz]
                         o_def rev_map
                    del: capFreeIndex_update.simps) apply (rule_tac P="\<lambda>x. valid_objs and pspace_aligned and pspace_distinct
                       and pspace_no_overlap {ptr .. ptr + 2 ^ sz - 1}
                       and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz
                           \<and> cap_is_device a = dev) slot"
                   and P'="\<lambda>_. valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {})
                       and pspace_no_overlap' ptr sz
                       and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = UntypedCap dev ptr sz idx) (cte_map slot)"
              in mapME_x_corres_same_xs) apply (rule corres_guard_imp) apply (rule corres_split_nor) apply (rule corres_machine_op) apply (rule corres_Id) apply (simp add: shiftL_nat getFreeRef_def shiftl_t2n mult.commute) apply simp apply wp apply (rule corres_split_nor) apply (rule updateFreeIndex_corres) apply simp apply (simp add: getFreeRef_def getFreeIndex_def free_index_of_def) apply clarify apply (subst unat_mult_simple) apply (subst unat_of_nat_eq) apply (rule order_less_trans[rotated],
                           rule_tac n=sz in power_strict_increasing; simp add: word_bits_def) apply (erule order_less_le_trans; simp) apply (subst unat_p2) apply (simp add: Kernel_Config.resetChunkBits_def) apply (rule order_less_trans[rotated],
                          rule_tac n=sz in power_strict_increasing; simp add: word_bits_def) apply (subst unat_of_nat_eq) apply (rule order_less_trans[rotated],
                          rule_tac n=sz in power_strict_increasing; simp add: word_bits_def) apply (erule order_less_le_trans; simp) apply simp apply (rule preemptionPoint_corres) apply wp+ apply (clarsimp simp: cte_wp_at_caps_of_state) apply (clarsimp simp: getFreeRef_def valid_pspace'_def cte_wp_at_ctes_of
                                 valid_cap_def cap_aligned_def) apply (erule aligned_add_aligned) apply (rule is_aligned_weaken) apply (rule is_aligned_mult_triv2) apply (simp add: Kernel_Config.resetChunkBits_def) apply (simp add: untyped_min_bits_def) apply (rule hoare_pre) apply simp apply (strengthen imp_consequent) apply (wp preemption_point_inv set_cap_cte_wp_at
                     update_untyped_cap_valid_objs
                     set_cap_no_overlap | simp)+ apply (clarsimp simp: exI cte_wp_at_caps_of_state) apply (drule caps_of_state_valid_cap, simp+) apply (clarsimp simp: is_cap_simps valid_cap_simps
                                cap_aligned_def
                                valid_untyped_pspace_no_overlap) apply (rule hoare_pre) apply (simp del: capFreeIndex_update.simps) apply (strengthen imp_consequent) apply (wp updateFreeIndex_valid_pspace_no_overlap'
                    updateFreeIndex_descendants_of2
                    doMachineOp_psp_no_overlap
                    updateFreeIndex_cte_wp_at
                    pspace_no_overlap'_lift
                    preemptionPoint_inv
                    hoare_vcg_ex_lift
                    | simp)+ apply (clarsimp simp add: cte_wp_at_ctes_of exI isCap_simps valid_pspace'_def) apply (clarsimp simp: getFreeIndex_def getFreeRef_def) apply (subst is_aligned_weaken[OF is_aligned_mult_triv2]) apply (simp add: Kernel_Config.resetChunkBits_def minUntypedSizeBits_def) apply (subst unat_mult_simple) apply (subst unat_of_nat_eq) apply (rule order_less_trans[rotated],
                  rule_tac n=sz in power_strict_increasing; simp add: word_bits_def) apply (erule order_less_le_trans; simp) apply (subst unat_p2) apply (simp add: Kernel_Config.resetChunkBits_def) apply (rule order_less_trans[rotated],
                 rule_tac n=sz in power_strict_increasing; simp add: word_bits_def) apply (subst unat_of_nat_eq) apply (rule order_less_trans[rotated],
                 rule_tac n=sz in power_strict_increasing; simp add: word_bits_def) apply (erule order_less_le_trans; simp) apply simp apply simp apply (simp add: if_apply_def2) apply (strengthen invs_valid_objs invs_psp_aligned invs_distinct) apply (wp hoare_vcg_const_imp_lift) apply (simp add: if_apply_def2) apply (strengthen invs_pspace_aligned' invs_pspace_distinct'
                        invs_valid_pspace') apply (wp hoare_vcg_const_imp_lift deleteObjects_cte_wp_at'[where p="cte_map slot"]
                deleteObjects_invs'[where p="cte_map slot"]
                deleteObjects_descendants[where p="cte_map slot"]
           | simp)+ apply (wp get_cap_wp getCTE_wp' | simp add: getSlotCap_def)+ apply (clarsimp simp: cte_wp_at_caps_of_state descendants_range_def2) apply (cases slot) apply (strengthen empty_descendants_range_in
                     ex_tupI[where x=slot])+ apply (frule(1) caps_of_state_valid) apply (clarsimp simp: valid_cap_simps cap_aligned_def) apply (frule(1) caps_of_state_valid) apply (frule if_unsafe_then_capD[OF caps_of_state_cteD], clarsimp+) apply (drule(1) ex_cte_cap_protects[OF _ caps_of_state_cteD
       empty_descendants_range_in _ order_refl], clarsimp+) apply (intro conjI impI; auto)[1] apply (clarsimp simp: cte_wp_at_ctes_of descendants_range'_def2
                        empty_descendants_range_in') apply (frule cte_wp_at_valid_objs_valid_cap'[OF ctes_of_cte_wpD], clarsimp+) apply (clarsimp simp: valid_cap_simps' capAligned_def is_aligned_weaken minUntypedSizeBits_def) apply (frule if_unsafe_then_capD'[OF ctes_of_cte_wpD], clarsimp+) apply (frule(1) descendants_range_ex_cte'[OF empty_descendants_range_in' _ order_refl],
    (simp add: isCap_simps)+) apply (intro conjI impI; clarsimp) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. untypinv_relation ui ui' \<Longrightarrow> corres (dc \<oplus> dc) (invs and valid_untyped_inv_wcap ui (Some (cap.UntypedCap dev ptr sz idx)) and ct_active and einvs and (\<lambda>_. \<exists>ptr_base ptr' ty us slots dev'. ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' ty us slots dev)) (invs' and valid_untyped_inv_wcap' ui' (Some (capability.UntypedCap dev ptr sz idx)) and ct_active') (reset_untyped_cap slot) (resetUntypedCap (cte_map slot)) proof (prove)
goal (1 subgoal):
 1. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') (reset_untyped_cap slot) (resetUntypedCap (cte_map slot)) proof (prove)
goal (1 subgoal):
 1. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') (do cap <- get_cap slot;
if free_index_of cap = 0 then returnOk () else doE liftE $ delete_objects (obj_ref_of cap) (bits_of cap);
dev <- returnOk $ is_device_untyped_cap cap;
if dev \<or> bits_of cap < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of cap) (2 ^ bits_of cap);
set_cap (cap.UntypedCap dev (obj_ref_of cap) (bits_of cap) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of cap + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (cap.UntypedCap dev (obj_ref_of cap) (bits_of cap) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of cap) [0..<2 ^ (bits_of cap - resetChunkBits)]))
odE
od) (do cap <- getSlotCap (cte_map slot);
unlessE (capFreeIndex cap = 0) (do y <- deleteObjects (capPtr cap) (capBlockSize cap);
if capIsDevice cap \<or> capBlockSize cap < resetChunkBits then withoutPreemption $ do unless (capIsDevice cap) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr cap))) (1 `~shiftL~` capBlockSize cap);
updateFreeIndex (cte_map slot) 0
od else forME_x (reverse [capPtr cap , capPtr cap + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr cap) (capFreeIndex cap) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex (cte_map slot) (getFreeIndex (capPtr cap) addr);
preemptionPoint
odE)
od)
od) proof (prove)
goal (3 subgoals):
 1. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?Q14 ptr_base ptr' us slots ao') (?Q'14 ptr_base ptr' us slots ao') (do cap <- get_cap slot;
if free_index_of cap = 0 then returnOk () else doE liftE $ delete_objects (obj_ref_of cap) (bits_of cap);
dev <- returnOk $ is_device_untyped_cap cap;
if dev \<or> bits_of cap < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of cap) (2 ^ bits_of cap);
set_cap (cap.UntypedCap dev (obj_ref_of cap) (bits_of cap) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of cap + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (cap.UntypedCap dev (obj_ref_of cap) (bits_of cap) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of cap) [0..<2 ^ (bits_of cap - resetChunkBits)]))
odE
od) (do cap <- getSlotCap (cte_map slot);
unlessE (capFreeIndex cap = 0) (do y <- deleteObjects (capPtr cap) (capBlockSize cap);
if capIsDevice cap \<or> capBlockSize cap < resetChunkBits then withoutPreemption $ do unless (capIsDevice cap) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr cap))) (1 `~shiftL~` capBlockSize cap);
updateFreeIndex (cte_map slot) 0
od else forME_x (reverse [capPtr cap , capPtr cap + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr cap) (capFreeIndex cap) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex (cte_map slot) (getFreeIndex (capPtr cap) addr);
preemptionPoint
odE)
od)
od)
 2. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> ?Q14 ptr_base ptr' us slots ao' s
 3. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> ?Q'14 ptr_base ptr' us slots ao' s proof (prove)
goal (6 subgoals):
 1. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> cte_map slot = cte_map slot
 2. \<And>ptr_base ptr' us slots ao' cap capa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; cap_relation cap capa\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R18 ptr_base ptr' us slots ao' cap) (?R'18 ptr_base ptr' us slots ao' capa) (if free_index_of cap = 0 then returnOk () else doE liftE $ delete_objects (obj_ref_of cap) (bits_of cap);
dev <- returnOk $ is_device_untyped_cap cap;
if dev \<or> bits_of cap < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of cap) (2 ^ bits_of cap);
set_cap (cap.UntypedCap dev (obj_ref_of cap) (bits_of cap) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of cap + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (cap.UntypedCap dev (obj_ref_of cap) (bits_of cap) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of cap) [0..<2 ^ (bits_of cap - resetChunkBits)]))
odE) (unlessE (capFreeIndex capa = 0) (do y <- deleteObjects (capPtr capa) (capBlockSize capa);
if capIsDevice capa \<or> capBlockSize capa < resetChunkBits then withoutPreemption $ do unless (capIsDevice capa) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr capa))) (1 `~shiftL~` capBlockSize capa);
updateFreeIndex (cte_map slot) 0
od else forME_x (reverse [capPtr capa , capPtr capa + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr capa) (capFreeIndex capa) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex (cte_map slot) (getFreeIndex (capPtr capa) addr);
preemptionPoint
odE)
od))
 3. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>?R18 ptr_base ptr' us slots ao'\<rbrace>
 4. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>?R'18 ptr_base ptr' us slots ao'\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 6. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (5 subgoals):
 1. \<And>ptr_base ptr' us slots ao' cap capa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; cap_relation cap capa\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R18 ptr_base ptr' us slots ao' cap) (?R'18 ptr_base ptr' us slots ao' capa) (if free_index_of cap = 0 then returnOk () else doE liftE $ delete_objects (obj_ref_of cap) (bits_of cap);
dev <- returnOk $ is_device_untyped_cap cap;
if dev \<or> bits_of cap < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of cap) (2 ^ bits_of cap);
set_cap (cap.UntypedCap dev (obj_ref_of cap) (bits_of cap) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of cap + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (cap.UntypedCap dev (obj_ref_of cap) (bits_of cap) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of cap) [0..<2 ^ (bits_of cap - resetChunkBits)]))
odE) (unlessE (capFreeIndex capa = 0) (do y <- deleteObjects (capPtr capa) (capBlockSize capa);
if capIsDevice capa \<or> capBlockSize capa < resetChunkBits then withoutPreemption $ do unless (capIsDevice capa) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr capa))) (1 `~shiftL~` capBlockSize capa);
updateFreeIndex (cte_map slot) 0
od else forME_x (reverse [capPtr capa , capPtr capa + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr capa) (capFreeIndex capa) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex (cte_map slot) (getFreeIndex (capPtr capa) addr);
preemptionPoint
odE)
od))
 2. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>?R18 ptr_base ptr' us slots ao'\<rbrace>
 3. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>?R'18 ptr_base ptr' us slots ao'\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 5. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (5 subgoals):
 1. \<And>ptr_base ptr' us slots ao' cap capa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; cap_relation cap capa; cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap)\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?P26 ptr_base ptr' us slots ao' cap) (?R'18 ptr_base ptr' us slots ao' capa) (if free_index_of cap = 0 then returnOk () else doE liftE $ delete_objects (obj_ref_of cap) (bits_of cap);
dev <- returnOk $ is_device_untyped_cap cap;
if dev \<or> bits_of cap < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of cap) (2 ^ bits_of cap);
set_cap (cap.UntypedCap dev (obj_ref_of cap) (bits_of cap) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of cap + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (cap.UntypedCap dev (obj_ref_of cap) (bits_of cap) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of cap) [0..<2 ^ (bits_of cap - resetChunkBits)]))
odE) (unlessE (capFreeIndex capa = 0) (do y <- deleteObjects (capPtr capa) (capBlockSize capa);
if capIsDevice capa \<or> capBlockSize capa < resetChunkBits then withoutPreemption $ do unless (capIsDevice capa) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr capa))) (1 `~shiftL~` capBlockSize capa);
updateFreeIndex (cte_map slot) 0
od else forME_x (reverse [capPtr capa , capPtr capa + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr capa) (capFreeIndex capa) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex (cte_map slot) (getFreeIndex (capPtr capa) addr);
preemptionPoint
odE)
od))
 2. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. ?P26 ptr_base ptr' us slots ao' cap and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 3. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>?R'18 ptr_base ptr' us slots ao'\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 5. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (5 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?P26 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)) (?R'18 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)) (if idx = 0 then returnOk () else doE liftE $ delete_objects (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (bits_of (cap.UntypedCap dev ptr sz idx));
deva <- returnOk $ is_device_untyped_cap (cap.UntypedCap dev ptr sz idx);
if deva \<or> bits_of (cap.UntypedCap dev ptr sz idx) < resetChunkBits then liftE $ do unless deva $ do_machine_op $ clearMemory (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (2 ^ bits_of (cap.UntypedCap dev ptr sz idx));
set_cap (cap.UntypedCap deva (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (bits_of (cap.UntypedCap dev ptr sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (cap.UntypedCap dev ptr sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (cap.UntypedCap deva (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (bits_of (cap.UntypedCap dev ptr sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap dev ptr sz idx)) [0..<2 ^ (bits_of (cap.UntypedCap dev ptr sz idx) - resetChunkBits)]))
odE) (if idx = 0 then returnOk () else do y <- deleteObjects (capPtr (capability.UntypedCap dev ptr sz idx)) (capBlockSize (capability.UntypedCap dev ptr sz idx));
if capIsDevice (capability.UntypedCap dev ptr sz idx) \<or> capBlockSize (capability.UntypedCap dev ptr sz idx) < resetChunkBits then withoutPreemption $ do unless (capIsDevice (capability.UntypedCap dev ptr sz idx)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (capability.UntypedCap dev ptr sz idx)))) (1 `~shiftL~` capBlockSize (capability.UntypedCap dev ptr sz idx));
updateFreeIndex (cte_map slot) 0
od else forME_x (reverse [capPtr (capability.UntypedCap dev ptr sz idx) , capPtr (capability.UntypedCap dev ptr sz idx) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (capability.UntypedCap dev ptr sz idx)) (capFreeIndex (capability.UntypedCap dev ptr sz idx)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex (cte_map slot) (getFreeIndex (capPtr (capability.UntypedCap dev ptr sz idx)) addr);
preemptionPoint
odE)
od)
 2. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. ?P26 ptr_base ptr' us slots ao' cap and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 3. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>?R'18 ptr_base ptr' us slots ao'\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 5. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (6 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?P60 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)) (?P'56 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)) (returnOk ()) (returnOk ())
 2. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?Q58 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)) (?Q'54 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)) (doE liftE $ delete_objects (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (bits_of (cap.UntypedCap dev ptr sz idx));
deva <- returnOk $ is_device_untyped_cap (cap.UntypedCap dev ptr sz idx);
if deva \<or> bits_of (cap.UntypedCap dev ptr sz idx) < resetChunkBits then liftE $ do unless deva $ do_machine_op $ clearMemory (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (2 ^ bits_of (cap.UntypedCap dev ptr sz idx));
set_cap (cap.UntypedCap deva (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (bits_of (cap.UntypedCap dev ptr sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (cap.UntypedCap dev ptr sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (cap.UntypedCap deva (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (bits_of (cap.UntypedCap dev ptr sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap dev ptr sz idx)) [0..<2 ^ (bits_of (cap.UntypedCap dev ptr sz idx) - resetChunkBits)]))
odE) (do y <- deleteObjects (capPtr (capability.UntypedCap dev ptr sz idx)) (capBlockSize (capability.UntypedCap dev ptr sz idx));
if capIsDevice (capability.UntypedCap dev ptr sz idx) \<or> capBlockSize (capability.UntypedCap dev ptr sz idx) < resetChunkBits then withoutPreemption $ do unless (capIsDevice (capability.UntypedCap dev ptr sz idx)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (capability.UntypedCap dev ptr sz idx)))) (1 `~shiftL~` capBlockSize (capability.UntypedCap dev ptr sz idx));
updateFreeIndex (cte_map slot) 0
od else forME_x (reverse [capPtr (capability.UntypedCap dev ptr sz idx) , capPtr (capability.UntypedCap dev ptr sz idx) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (capability.UntypedCap dev ptr sz idx)) (capFreeIndex (capability.UntypedCap dev ptr sz idx)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex (cte_map slot) (getFreeIndex (capPtr (capability.UntypedCap dev ptr sz idx)) addr);
preemptionPoint
odE)
od)
 3. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then ?P60 ptr_base ptr' us slots ao' cap else ?Q58 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 4. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then ?P'56 ptr_base ptr' us slots ao' a else ?Q'54 ptr_base ptr' us slots ao' a\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 6. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (5 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?Q58 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)) (?Q'54 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)) (doE liftE $ delete_objects (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (bits_of (cap.UntypedCap dev ptr sz idx));
deva <- returnOk $ is_device_untyped_cap (cap.UntypedCap dev ptr sz idx);
if deva \<or> bits_of (cap.UntypedCap dev ptr sz idx) < resetChunkBits then liftE $ do unless deva $ do_machine_op $ clearMemory (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (2 ^ bits_of (cap.UntypedCap dev ptr sz idx));
set_cap (cap.UntypedCap deva (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (bits_of (cap.UntypedCap dev ptr sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (cap.UntypedCap dev ptr sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (cap.UntypedCap deva (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (bits_of (cap.UntypedCap dev ptr sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap dev ptr sz idx)) [0..<2 ^ (bits_of (cap.UntypedCap dev ptr sz idx) - resetChunkBits)]))
odE) (do y <- deleteObjects (capPtr (capability.UntypedCap dev ptr sz idx)) (capBlockSize (capability.UntypedCap dev ptr sz idx));
if capIsDevice (capability.UntypedCap dev ptr sz idx) \<or> capBlockSize (capability.UntypedCap dev ptr sz idx) < resetChunkBits then withoutPreemption $ do unless (capIsDevice (capability.UntypedCap dev ptr sz idx)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (capability.UntypedCap dev ptr sz idx)))) (1 `~shiftL~` capBlockSize (capability.UntypedCap dev ptr sz idx));
updateFreeIndex (cte_map slot) 0
od else forME_x (reverse [capPtr (capability.UntypedCap dev ptr sz idx) , capPtr (capability.UntypedCap dev ptr sz idx) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (capability.UntypedCap dev ptr sz idx)) (capFreeIndex (capability.UntypedCap dev ptr sz idx)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex (cte_map slot) (getFreeIndex (capPtr (capability.UntypedCap dev ptr sz idx)) addr);
preemptionPoint
odE)
od)
 2. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else ?Q58 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 3. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else ?Q'54 ptr_base ptr' us slots ao' a\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 5. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (5 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?Q58 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)) (?Q'54 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)) (do a <- delete_objects ptr sz;
if dev \<or> sz < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (2 ^ bits_of (cap.UntypedCap dev ptr sz idx));
set_cap (cap.UntypedCap dev (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (bits_of (cap.UntypedCap dev ptr sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (cap.UntypedCap dev ptr sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (cap.UntypedCap dev (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (bits_of (cap.UntypedCap dev ptr sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap dev ptr sz idx)) [0..<2 ^ (bits_of (cap.UntypedCap dev ptr sz idx) - resetChunkBits)]))
od) (do y <- deleteObjects ptr sz;
if dev \<or> sz < resetChunkBits then withoutPreemption $ do unless (capIsDevice (capability.UntypedCap dev ptr sz idx)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (capability.UntypedCap dev ptr sz idx)))) (1 `~shiftL~` capBlockSize (capability.UntypedCap dev ptr sz idx));
updateFreeIndex (cte_map slot) 0
od else forME_x (reverse [capPtr (capability.UntypedCap dev ptr sz idx) , capPtr (capability.UntypedCap dev ptr sz idx) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (capability.UntypedCap dev ptr sz idx)) (capFreeIndex (capability.UntypedCap dev ptr sz idx)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex (cte_map slot) (getFreeIndex (capPtr (capability.UntypedCap dev ptr sz idx)) addr);
preemptionPoint
odE)
od)
 2. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else ?Q58 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 3. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else ?Q'54 ptr_base ptr' us slots ao' a\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 5. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (8 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> corres (?r'66 ptr_base ptr' us slots ao' x) (?P89 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)) (?P'85 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)) (delete_objects ptr sz) (deleteObjects ptr sz)
 2. \<And>ptr_base ptr' us slots ao' x rv rv'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; ?r'66 ptr_base ptr' us slots ao' x rv rv'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R66 ptr_base ptr' us slots ao' x rv) (?R'66 ptr_base ptr' us slots ao' x rv') (if dev \<or> sz < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (2 ^ bits_of (cap.UntypedCap dev ptr sz idx));
set_cap (cap.UntypedCap dev (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (bits_of (cap.UntypedCap dev ptr sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (cap.UntypedCap dev ptr sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (cap.UntypedCap dev (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (bits_of (cap.UntypedCap dev ptr sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap dev ptr sz idx)) [0..<2 ^ (bits_of (cap.UntypedCap dev ptr sz idx) - resetChunkBits)]))) (if dev \<or> sz < resetChunkBits then withoutPreemption $ do unless (capIsDevice (capability.UntypedCap dev ptr sz idx)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (capability.UntypedCap dev ptr sz idx)))) (1 `~shiftL~` capBlockSize (capability.UntypedCap dev ptr sz idx));
updateFreeIndex (cte_map slot) 0
od else forME_x (reverse [capPtr (capability.UntypedCap dev ptr sz idx) , capPtr (capability.UntypedCap dev ptr sz idx) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (capability.UntypedCap dev ptr sz idx)) (capFreeIndex (capability.UntypedCap dev ptr sz idx)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex (cte_map slot) (getFreeIndex (capPtr (capability.UntypedCap dev ptr sz idx)) addr);
preemptionPoint
odE))
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>?R66 ptr_base ptr' us slots ao' x\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>?R'66 ptr_base ptr' us slots ao' x\<rbrace>
 5. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else ?P89 ptr_base ptr' us slots ao' cap and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 6. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else ?P'85 ptr_base ptr' us slots ao' a and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 8. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (9 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> is_aligned ptr sz
 2. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> 2 \<le> sz
 3. \<And>ptr_base ptr' us slots ao' x rv rv'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; dc rv rv'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R66 ptr_base ptr' us slots ao' x rv) (?R'66 ptr_base ptr' us slots ao' x rv') (if dev \<or> sz < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (2 ^ bits_of (cap.UntypedCap dev ptr sz idx));
set_cap (cap.UntypedCap dev (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (bits_of (cap.UntypedCap dev ptr sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (cap.UntypedCap dev ptr sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (cap.UntypedCap dev (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (bits_of (cap.UntypedCap dev ptr sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap dev ptr sz idx)) [0..<2 ^ (bits_of (cap.UntypedCap dev ptr sz idx) - resetChunkBits)]))) (if dev \<or> sz < resetChunkBits then withoutPreemption $ do unless (capIsDevice (capability.UntypedCap dev ptr sz idx)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (capability.UntypedCap dev ptr sz idx)))) (1 `~shiftL~` capBlockSize (capability.UntypedCap dev ptr sz idx));
updateFreeIndex (cte_map slot) 0
od else forME_x (reverse [capPtr (capability.UntypedCap dev ptr sz idx) , capPtr (capability.UntypedCap dev ptr sz idx) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (capability.UntypedCap dev ptr sz idx)) (capFreeIndex (capability.UntypedCap dev ptr sz idx)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex (cte_map slot) (getFreeIndex (capPtr (capability.UntypedCap dev ptr sz idx)) addr);
preemptionPoint
odE))
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>?R66 ptr_base ptr' us slots ao' x\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>?R'66 ptr_base ptr' us slots ao' x\<rbrace>
 6. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 7. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 8. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 9. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (8 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> 2 \<le> sz
 2. \<And>ptr_base ptr' us slots ao' x rv rv'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; dc rv rv'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R66 ptr_base ptr' us slots ao' x rv) (?R'66 ptr_base ptr' us slots ao' x rv') (if dev \<or> sz < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (2 ^ bits_of (cap.UntypedCap dev ptr sz idx));
set_cap (cap.UntypedCap dev (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (bits_of (cap.UntypedCap dev ptr sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (cap.UntypedCap dev ptr sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (cap.UntypedCap dev (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (bits_of (cap.UntypedCap dev ptr sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap dev ptr sz idx)) [0..<2 ^ (bits_of (cap.UntypedCap dev ptr sz idx) - resetChunkBits)]))) (if dev \<or> sz < resetChunkBits then withoutPreemption $ do unless (capIsDevice (capability.UntypedCap dev ptr sz idx)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (capability.UntypedCap dev ptr sz idx)))) (1 `~shiftL~` capBlockSize (capability.UntypedCap dev ptr sz idx));
updateFreeIndex (cte_map slot) 0
od else forME_x (reverse [capPtr (capability.UntypedCap dev ptr sz idx) , capPtr (capability.UntypedCap dev ptr sz idx) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (capability.UntypedCap dev ptr sz idx)) (capFreeIndex (capability.UntypedCap dev ptr sz idx)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex (cte_map slot) (getFreeIndex (capPtr (capability.UntypedCap dev ptr sz idx)) addr);
preemptionPoint
odE))
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>?R66 ptr_base ptr' us slots ao' x\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>?R'66 ptr_base ptr' us slots ao' x\<rbrace>
 5. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 6. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 8. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (7 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x rv rv'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; dc rv rv'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R66 ptr_base ptr' us slots ao' x rv) (?R'66 ptr_base ptr' us slots ao' x rv') (if dev \<or> sz < resetChunkBits then liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (2 ^ bits_of (cap.UntypedCap dev ptr sz idx));
set_cap (cap.UntypedCap dev (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (bits_of (cap.UntypedCap dev ptr sz idx)) 0) slot
od else mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (cap.UntypedCap dev ptr sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (cap.UntypedCap dev (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (bits_of (cap.UntypedCap dev ptr sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap dev ptr sz idx)) [0..<2 ^ (bits_of (cap.UntypedCap dev ptr sz idx) - resetChunkBits)]))) (if dev \<or> sz < resetChunkBits then withoutPreemption $ do unless (capIsDevice (capability.UntypedCap dev ptr sz idx)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (capability.UntypedCap dev ptr sz idx)))) (1 `~shiftL~` capBlockSize (capability.UntypedCap dev ptr sz idx));
updateFreeIndex (cte_map slot) 0
od else forME_x (reverse [capPtr (capability.UntypedCap dev ptr sz idx) , capPtr (capability.UntypedCap dev ptr sz idx) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (capability.UntypedCap dev ptr sz idx)) (capFreeIndex (capability.UntypedCap dev ptr sz idx)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex (cte_map slot) (getFreeIndex (capPtr (capability.UntypedCap dev ptr sz idx)) addr);
preemptionPoint
odE))
 2. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>?R66 ptr_base ptr' us slots ao' x\<rbrace>
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>?R'66 ptr_base ptr' us slots ao' x\<rbrace>
 4. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 5. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 7. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (9 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x rv rv'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; dc rv rv'\<rbrakk> \<Longrightarrow> (dev \<or> sz < resetChunkBits) = (dev \<or> sz < resetChunkBits)
 2. \<And>ptr_base ptr' us slots ao' x rv rv'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; dc rv rv'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?P110 ptr_base ptr' us slots ao' x rv) (?P'113 ptr_base ptr' us slots ao' x rv') (liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (2 ^ bits_of (cap.UntypedCap dev ptr sz idx));
set_cap (cap.UntypedCap dev (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (bits_of (cap.UntypedCap dev ptr sz idx)) 0) slot
od) (withoutPreemption $ do unless (capIsDevice (capability.UntypedCap dev ptr sz idx)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (capability.UntypedCap dev ptr sz idx)))) (1 `~shiftL~` capBlockSize (capability.UntypedCap dev ptr sz idx));
updateFreeIndex (cte_map slot) 0
od)
 3. \<And>ptr_base ptr' us slots ao' x rv rv'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; dc rv rv'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?Q111 ptr_base ptr' us slots ao' x rv) (?Q'114 ptr_base ptr' us slots ao' x rv') (mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (cap.UntypedCap dev ptr sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (cap.UntypedCap dev (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (bits_of (cap.UntypedCap dev ptr sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap dev ptr sz idx)) [0..<2 ^ (bits_of (cap.UntypedCap dev ptr sz idx) - resetChunkBits)]))) (forME_x (reverse [capPtr (capability.UntypedCap dev ptr sz idx) , capPtr (capability.UntypedCap dev ptr sz idx) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (capability.UntypedCap dev ptr sz idx)) (capFreeIndex (capability.UntypedCap dev ptr sz idx)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex (cte_map slot) (getFreeIndex (capPtr (capability.UntypedCap dev ptr sz idx)) addr);
preemptionPoint
odE))
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then ?P110 ptr_base ptr' us slots ao' x rv else ?Q111 ptr_base ptr' us slots ao' x rv\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then ?P'113 ptr_base ptr' us slots ao' x rv' else ?Q'114 ptr_base ptr' us slots ao' x rv'\<rbrace>
 6. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 7. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 8. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 9. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (8 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x rv rv'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; dc rv rv'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?P110 ptr_base ptr' us slots ao' x rv) (?P'113 ptr_base ptr' us slots ao' x rv') (liftE $ do unless dev $ do_machine_op $ clearMemory (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (2 ^ bits_of (cap.UntypedCap dev ptr sz idx));
set_cap (cap.UntypedCap dev (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (bits_of (cap.UntypedCap dev ptr sz idx)) 0) slot
od) (withoutPreemption $ do unless (capIsDevice (capability.UntypedCap dev ptr sz idx)) $ doMachineOp $ clearMemory (PPtr (fromPPtr (capPtr (capability.UntypedCap dev ptr sz idx)))) (1 `~shiftL~` capBlockSize (capability.UntypedCap dev ptr sz idx));
updateFreeIndex (cte_map slot) 0
od)
 2. \<And>ptr_base ptr' us slots ao' x rv rv'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; dc rv rv'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?Q111 ptr_base ptr' us slots ao' x rv) (?Q'114 ptr_base ptr' us slots ao' x rv') (mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (cap.UntypedCap dev ptr sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (cap.UntypedCap dev (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (bits_of (cap.UntypedCap dev ptr sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap dev ptr sz idx)) [0..<2 ^ (bits_of (cap.UntypedCap dev ptr sz idx) - resetChunkBits)]))) (forME_x (reverse [capPtr (capability.UntypedCap dev ptr sz idx) , capPtr (capability.UntypedCap dev ptr sz idx) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (capability.UntypedCap dev ptr sz idx)) (capFreeIndex (capability.UntypedCap dev ptr sz idx)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex (cte_map slot) (getFreeIndex (capPtr (capability.UntypedCap dev ptr sz idx)) addr);
preemptionPoint
odE))
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then ?P110 ptr_base ptr' us slots ao' x rv else ?Q111 ptr_base ptr' us slots ao' x rv\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then ?P'113 ptr_base ptr' us slots ao' x rv' else ?Q'114 ptr_base ptr' us slots ao' x rv'\<rbrace>
 5. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 6. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 8. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (8 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> corres dc (?P110 ptr_base ptr' us slots ao' x ()) (?P'113 ptr_base ptr' us slots ao' x ()) (do a <- unless dev (do_machine_op (clearMemory ptr (2 ^ sz)));
set_cap (cap.UntypedCap dev ptr sz 0) slot
od) (do a <- unless dev (doMachineOp (clearMemory ptr (2 ^ sz)));
updateFreeIndex (cte_map slot) 0
od)
 2. \<And>ptr_base ptr' us slots ao' x rv rv'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; dc rv rv'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?Q111 ptr_base ptr' us slots ao' x rv) (?Q'114 ptr_base ptr' us slots ao' x rv') (mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (cap.UntypedCap dev ptr sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (cap.UntypedCap dev (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (bits_of (cap.UntypedCap dev ptr sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap dev ptr sz idx)) [0..<2 ^ (bits_of (cap.UntypedCap dev ptr sz idx) - resetChunkBits)]))) (forME_x (reverse [capPtr (capability.UntypedCap dev ptr sz idx) , capPtr (capability.UntypedCap dev ptr sz idx) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (capability.UntypedCap dev ptr sz idx)) (capFreeIndex (capability.UntypedCap dev ptr sz idx)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex (cte_map slot) (getFreeIndex (capPtr (capability.UntypedCap dev ptr sz idx)) addr);
preemptionPoint
odE))
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then ?P110 ptr_base ptr' us slots ao' x rv else ?Q111 ptr_base ptr' us slots ao' x rv\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then ?P'113 ptr_base ptr' us slots ao' x rv' else ?Q'114 ptr_base ptr' us slots ao' x rv'\<rbrace>
 5. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 6. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 8. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (11 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> corres dc (?P126 ptr_base ptr' us slots ao' x ()) (?P'124 ptr_base ptr' us slots ao' x ()) (unless dev (do_machine_op (clearMemory ptr (2 ^ sz)))) (unless dev (doMachineOp (clearMemory ptr (2 ^ sz))))
 2. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> corres dc (?R118 ptr_base ptr' us slots ao' x) (?R'118 ptr_base ptr' us slots ao' x) (set_cap (cap.UntypedCap dev ptr sz 0) slot) (updateFreeIndex (cte_map slot) 0)
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q125 ptr_base ptr' us slots ao' x ()\<rbrace> unless dev (do_machine_op (clearMemory ptr (2 ^ sz))) \<lbrace>\<lambda>xa. ?R118 ptr_base ptr' us slots ao' x\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'123 ptr_base ptr' us slots ao' x ()\<rbrace> unless dev (doMachineOp (clearMemory ptr (2 ^ sz))) \<lbrace>\<lambda>xa. ?R'118 ptr_base ptr' us slots ao' x\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x rv rv'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; dc rv rv'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?Q111 ptr_base ptr' us slots ao' x rv) (?Q'114 ptr_base ptr' us slots ao' x rv') (mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (cap.UntypedCap dev ptr sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (cap.UntypedCap dev (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (bits_of (cap.UntypedCap dev ptr sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap dev ptr sz idx)) [0..<2 ^ (bits_of (cap.UntypedCap dev ptr sz idx) - resetChunkBits)]))) (forME_x (reverse [capPtr (capability.UntypedCap dev ptr sz idx) , capPtr (capability.UntypedCap dev ptr sz idx) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (capability.UntypedCap dev ptr sz idx)) (capFreeIndex (capability.UntypedCap dev ptr sz idx)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex (cte_map slot) (getFreeIndex (capPtr (capability.UntypedCap dev ptr sz idx)) addr);
preemptionPoint
odE))
 6. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then ?P126 ptr_base ptr' us slots ao' x rv and ?Q125 ptr_base ptr' us slots ao' x rv else ?Q111 ptr_base ptr' us slots ao' x rv\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then ?P'124 ptr_base ptr' us slots ao' x rv' and ?Q'123 ptr_base ptr' us slots ao' x rv' else ?Q'114 ptr_base ptr' us slots ao' x rv'\<rbrace>
 8. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 9. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 10. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> corres dc (?P126 ptr_base ptr' us slots ao' x ()) (?P'124 ptr_base ptr' us slots ao' x ()) (when (\<not> dev) (do_machine_op (clearMemory ptr (2 ^ sz)))) (when (\<not> dev) (doMachineOp (clearMemory ptr (2 ^ sz))))
 2. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> corres dc (?R118 ptr_base ptr' us slots ao' x) (?R'118 ptr_base ptr' us slots ao' x) (set_cap (cap.UntypedCap dev ptr sz 0) slot) (updateFreeIndex (cte_map slot) 0)
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q125 ptr_base ptr' us slots ao' x ()\<rbrace> unless dev (do_machine_op (clearMemory ptr (2 ^ sz))) \<lbrace>\<lambda>xa. ?R118 ptr_base ptr' us slots ao' x\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'123 ptr_base ptr' us slots ao' x ()\<rbrace> unless dev (doMachineOp (clearMemory ptr (2 ^ sz))) \<lbrace>\<lambda>xa. ?R'118 ptr_base ptr' us slots ao' x\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x rv rv'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; dc rv rv'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?Q111 ptr_base ptr' us slots ao' x rv) (?Q'114 ptr_base ptr' us slots ao' x rv') (mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (cap.UntypedCap dev ptr sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (cap.UntypedCap dev (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (bits_of (cap.UntypedCap dev ptr sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap dev ptr sz idx)) [0..<2 ^ (bits_of (cap.UntypedCap dev ptr sz idx) - resetChunkBits)]))) (forME_x (reverse [capPtr (capability.UntypedCap dev ptr sz idx) , capPtr (capability.UntypedCap dev ptr sz idx) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (capability.UntypedCap dev ptr sz idx)) (capFreeIndex (capability.UntypedCap dev ptr sz idx)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex (cte_map slot) (getFreeIndex (capPtr (capability.UntypedCap dev ptr sz idx)) addr);
preemptionPoint
odE))
 6. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then ?P126 ptr_base ptr' us slots ao' x rv and ?Q125 ptr_base ptr' us slots ao' x rv else ?Q111 ptr_base ptr' us slots ao' x rv\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then ?P'124 ptr_base ptr' us slots ao' x rv' and ?Q'123 ptr_base ptr' us slots ao' x rv' else ?Q'114 ptr_base ptr' us slots ao' x rv'\<rbrace>
 8. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 9. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 10. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> corres dc (?P133 ptr_base ptr' us slots ao' x ()) (?P'132 ptr_base ptr' us slots ao' x ()) (do_machine_op (clearMemory ptr (2 ^ sz))) (doMachineOp (clearMemory ptr (2 ^ sz)))
 2. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> corres dc (?R118 ptr_base ptr' us slots ao' x) (?R'118 ptr_base ptr' us slots ao' x) (set_cap (cap.UntypedCap dev ptr sz 0) slot) (updateFreeIndex (cte_map slot) 0)
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q125 ptr_base ptr' us slots ao' x ()\<rbrace> unless dev (do_machine_op (clearMemory ptr (2 ^ sz))) \<lbrace>\<lambda>xa. ?R118 ptr_base ptr' us slots ao' x\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'123 ptr_base ptr' us slots ao' x ()\<rbrace> unless dev (doMachineOp (clearMemory ptr (2 ^ sz))) \<lbrace>\<lambda>xa. ?R'118 ptr_base ptr' us slots ao' x\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x rv rv'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; dc rv rv'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?Q111 ptr_base ptr' us slots ao' x rv) (?Q'114 ptr_base ptr' us slots ao' x rv') (mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (cap.UntypedCap dev ptr sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (cap.UntypedCap dev (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (bits_of (cap.UntypedCap dev ptr sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap dev ptr sz idx)) [0..<2 ^ (bits_of (cap.UntypedCap dev ptr sz idx) - resetChunkBits)]))) (forME_x (reverse [capPtr (capability.UntypedCap dev ptr sz idx) , capPtr (capability.UntypedCap dev ptr sz idx) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (capability.UntypedCap dev ptr sz idx)) (capFreeIndex (capability.UntypedCap dev ptr sz idx)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex (cte_map slot) (getFreeIndex (capPtr (capability.UntypedCap dev ptr sz idx)) addr);
preemptionPoint
odE))
 6. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ?P133 ptr_base ptr' us slots ao' x rv a) and ?Q125 ptr_base ptr' us slots ao' x rv else ?Q111 ptr_base ptr' us slots ao' x rv\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ?P'132 ptr_base ptr' us slots ao' x rv' a) and ?Q'123 ptr_base ptr' us slots ao' x rv' else ?Q'114 ptr_base ptr' us slots ao' x rv'\<rbrace>
 8. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 9. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 10. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> corres_underlying Id False True dc (?P140 ptr_base ptr' us slots ao' x ()) (?Q139 ptr_base ptr' us slots ao' x ()) (clearMemory ptr (2 ^ sz)) (clearMemory ptr (2 ^ sz))
 2. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> corres dc (?R118 ptr_base ptr' us slots ao' x) (?R'118 ptr_base ptr' us slots ao' x) (set_cap (cap.UntypedCap dev ptr sz 0) slot) (updateFreeIndex (cte_map slot) 0)
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q125 ptr_base ptr' us slots ao' x ()\<rbrace> unless dev (do_machine_op (clearMemory ptr (2 ^ sz))) \<lbrace>\<lambda>xa. ?R118 ptr_base ptr' us slots ao' x\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'123 ptr_base ptr' us slots ao' x ()\<rbrace> unless dev (doMachineOp (clearMemory ptr (2 ^ sz))) \<lbrace>\<lambda>xa. ?R'118 ptr_base ptr' us slots ao' x\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x rv rv'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; dc rv rv'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?Q111 ptr_base ptr' us slots ao' x rv) (?Q'114 ptr_base ptr' us slots ao' x rv') (mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (cap.UntypedCap dev ptr sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (cap.UntypedCap dev (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (bits_of (cap.UntypedCap dev ptr sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap dev ptr sz idx)) [0..<2 ^ (bits_of (cap.UntypedCap dev ptr sz idx) - resetChunkBits)]))) (forME_x (reverse [capPtr (capability.UntypedCap dev ptr sz idx) , capPtr (capability.UntypedCap dev ptr sz idx) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (capability.UntypedCap dev ptr sz idx)) (capFreeIndex (capability.UntypedCap dev ptr sz idx)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex (cte_map slot) (getFreeIndex (capPtr (capability.UntypedCap dev ptr sz idx)) addr);
preemptionPoint
odE))
 6. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> (?P140 ptr_base ptr' us slots ao' x rv \<circ> machine_state) a) and ?Q125 ptr_base ptr' us slots ao' x rv else ?Q111 ptr_base ptr' us slots ao' x rv\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> (?Q139 ptr_base ptr' us slots ao' x rv' \<circ> ksMachineState) a) and ?Q'123 ptr_base ptr' us slots ao' x rv' else ?Q'114 ptr_base ptr' us slots ao' x rv'\<rbrace>
 8. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 9. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 10. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> corres dc (?R118 ptr_base ptr' us slots ao' x) (?R'118 ptr_base ptr' us slots ao' x) (set_cap (cap.UntypedCap dev ptr sz 0) slot) (updateFreeIndex (cte_map slot) 0)
 2. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q125 ptr_base ptr' us slots ao' x ()\<rbrace> unless dev (do_machine_op (clearMemory ptr (2 ^ sz))) \<lbrace>\<lambda>xa. ?R118 ptr_base ptr' us slots ao' x\<rbrace>
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'123 ptr_base ptr' us slots ao' x ()\<rbrace> unless dev (doMachineOp (clearMemory ptr (2 ^ sz))) \<lbrace>\<lambda>xa. ?R'118 ptr_base ptr' us slots ao' x\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' x rv rv'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; dc rv rv'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?Q111 ptr_base ptr' us slots ao' x rv) (?Q'114 ptr_base ptr' us slots ao' x rv') (mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (cap.UntypedCap dev ptr sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (cap.UntypedCap dev (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (bits_of (cap.UntypedCap dev ptr sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap dev ptr sz idx)) [0..<2 ^ (bits_of (cap.UntypedCap dev ptr sz idx) - resetChunkBits)]))) (forME_x (reverse [capPtr (capability.UntypedCap dev ptr sz idx) , capPtr (capability.UntypedCap dev ptr sz idx) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (capability.UntypedCap dev ptr sz idx)) (capFreeIndex (capability.UntypedCap dev ptr sz idx)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex (cte_map slot) (getFreeIndex (capPtr (capability.UntypedCap dev ptr sz idx)) addr);
preemptionPoint
odE))
 5. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and ?Q125 ptr_base ptr' us slots ao' x rv else ?Q111 ptr_base ptr' us slots ao' x rv\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and ?Q'123 ptr_base ptr' us slots ao' x rv' else ?Q'114 ptr_base ptr' us slots ao' x rv'\<rbrace>
 7. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 8. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 9. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 10. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (10 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> free_index_of (cap.UntypedCap dev ptr sz 0) = 0
 2. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q125 ptr_base ptr' us slots ao' x ()\<rbrace> unless dev (do_machine_op (clearMemory ptr (2 ^ sz))) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot and valid_objs and pspace_aligned and pspace_distinct\<rbrace>
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'123 ptr_base ptr' us slots ao' x ()\<rbrace> unless dev (doMachineOp (clearMemory ptr (2 ^ sz))) \<lbrace>\<lambda>x. cte_wp_at' (\<lambda>_. True) (cte_map slot) and pspace_distinct' and pspace_aligned'\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' x rv rv'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; dc rv rv'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?Q111 ptr_base ptr' us slots ao' x rv) (?Q'114 ptr_base ptr' us slots ao' x rv') (mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (cap.UntypedCap dev ptr sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (cap.UntypedCap dev (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (bits_of (cap.UntypedCap dev ptr sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap dev ptr sz idx)) [0..<2 ^ (bits_of (cap.UntypedCap dev ptr sz idx) - resetChunkBits)]))) (forME_x (reverse [capPtr (capability.UntypedCap dev ptr sz idx) , capPtr (capability.UntypedCap dev ptr sz idx) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (capability.UntypedCap dev ptr sz idx)) (capFreeIndex (capability.UntypedCap dev ptr sz idx)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex (cte_map slot) (getFreeIndex (capPtr (capability.UntypedCap dev ptr sz idx)) addr);
preemptionPoint
odE))
 5. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and ?Q125 ptr_base ptr' us slots ao' x rv else ?Q111 ptr_base ptr' us slots ao' x rv\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and ?Q'123 ptr_base ptr' us slots ao' x rv' else ?Q'114 ptr_base ptr' us slots ao' x rv'\<rbrace>
 7. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 8. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 9. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 10. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (9 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q125 ptr_base ptr' us slots ao' x ()\<rbrace> unless dev (do_machine_op (clearMemory ptr (2 ^ sz))) \<lbrace>\<lambda>x. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot and valid_objs and pspace_aligned and pspace_distinct\<rbrace>
 2. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'123 ptr_base ptr' us slots ao' x ()\<rbrace> unless dev (doMachineOp (clearMemory ptr (2 ^ sz))) \<lbrace>\<lambda>x. cte_wp_at' (\<lambda>_. True) (cte_map slot) and pspace_distinct' and pspace_aligned'\<rbrace>
 3. \<And>ptr_base ptr' us slots ao' x rv rv'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; dc rv rv'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?Q111 ptr_base ptr' us slots ao' x rv) (?Q'114 ptr_base ptr' us slots ao' x rv') (mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (cap.UntypedCap dev ptr sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (cap.UntypedCap dev (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (bits_of (cap.UntypedCap dev ptr sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap dev ptr sz idx)) [0..<2 ^ (bits_of (cap.UntypedCap dev ptr sz idx) - resetChunkBits)]))) (forME_x (reverse [capPtr (capability.UntypedCap dev ptr sz idx) , capPtr (capability.UntypedCap dev ptr sz idx) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (capability.UntypedCap dev ptr sz idx)) (capFreeIndex (capability.UntypedCap dev ptr sz idx)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex (cte_map slot) (getFreeIndex (capPtr (capability.UntypedCap dev ptr sz idx)) addr);
preemptionPoint
odE))
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and ?Q125 ptr_base ptr' us slots ao' x rv else ?Q111 ptr_base ptr' us slots ao' x rv\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and ?Q'123 ptr_base ptr' us slots ao' x rv' else ?Q'114 ptr_base ptr' us slots ao' x rv'\<rbrace>
 6. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 7. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 8. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 9. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (7 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x rv rv'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; dc rv rv'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?Q111 ptr_base ptr' us slots ao' x rv) (?Q'114 ptr_base ptr' us slots ao' x rv') (mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (cap.UntypedCap dev ptr sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (cap.UntypedCap dev (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (bits_of (cap.UntypedCap dev ptr sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap dev ptr sz idx)) [0..<2 ^ (bits_of (cap.UntypedCap dev ptr sz idx) - resetChunkBits)]))) (forME_x (reverse [capPtr (capability.UntypedCap dev ptr sz idx) , capPtr (capability.UntypedCap dev ptr sz idx) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (capability.UntypedCap dev ptr sz idx)) (capFreeIndex (capability.UntypedCap dev ptr sz idx)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex (cte_map slot) (getFreeIndex (capPtr (capability.UntypedCap dev ptr sz idx)) addr);
preemptionPoint
odE))
 2. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else ?Q111 ptr_base ptr' us slots ao' x rv\<rbrace>
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else ?Q'114 ptr_base ptr' us slots ao' x rv'\<rbrace>
 4. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 5. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 7. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (7 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x rv rv'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; dc rv rv'; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?P192 ptr_base ptr' us slots ao' x rv) (?Q'114 ptr_base ptr' us slots ao' x rv') (mapME_x (\<lambda>i. doE liftE $ do_machine_op $ clearMemory (obj_ref_of (cap.UntypedCap dev ptr sz idx) + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits);
liftE $ set_cap (cap.UntypedCap dev (obj_ref_of (cap.UntypedCap dev ptr sz idx)) (bits_of (cap.UntypedCap dev ptr sz idx)) (i * 2 ^ resetChunkBits)) slot;
preemption_point
odE) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap dev ptr sz idx)) [0..<2 ^ (bits_of (cap.UntypedCap dev ptr sz idx) - resetChunkBits)]))) (forME_x (reverse [capPtr (capability.UntypedCap dev ptr sz idx) , capPtr (capability.UntypedCap dev ptr sz idx) + 1 `~shiftL~` resetChunkBits .e. getFreeRef (capPtr (capability.UntypedCap dev ptr sz idx)) (capFreeIndex (capability.UntypedCap dev ptr sz idx)) - 1]) (\<lambda>addr. doE withoutPreemption $ doMachineOp $ clearMemory (PPtr (fromPPtr addr)) (1 `~shiftL~` resetChunkBits);
withoutPreemption $ updateFreeIndex (cte_map slot) (getFreeIndex (capPtr (capability.UntypedCap dev ptr sz idx)) addr);
preemptionPoint
odE))
 2. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else ?P192 ptr_base ptr' us slots ao' x rv and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else ?Q'114 ptr_base ptr' us slots ao' x rv'\<rbrace>
 4. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 5. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 7. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (7 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?P192 ptr_base ptr' us slots ao' x ()) (?Q'114 ptr_base ptr' us slots ao' x ()) (mapME_x (\<lambda>i. do a <- do_machine_op (clearMemory (ptr + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (i * 2 ^ resetChunkBits)) slot;
preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))) (mapME_x (\<lambda>x. do a <- doMachineOp (clearMemory (getFreeRef ptr (x * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (x * 2 ^ resetChunkBits)));
preemptionPoint
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])))
 2. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else ?P192 ptr_base ptr' us slots ao' x rv and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else ?Q'114 ptr_base ptr' us slots ao' x rv'\<rbrace>
 4. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 5. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 7. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (10 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) (do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od) (do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od)
 2. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace> do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace>, -
 3. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace>, -
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 5. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 7. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 8. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 9. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 10. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (12 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?Q220 ptr_base ptr' us slots ao' x xa) (?Q'220 ptr_base ptr' us slots ao' x xa) (do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od) (do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od)
 2. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrakk> \<Longrightarrow> ?Q220 ptr_base ptr' us slots ao' x xa s
 3. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrakk> \<Longrightarrow> ?Q'220 ptr_base ptr' us slots ao' x xa s
 4. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace> do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace>, -
 5. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace>, -
 6. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 7. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 8. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 9. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 10. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
A total of 12 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> corres dc (?P224 ptr_base ptr' us slots ao' x xa) (?P'224 ptr_base ptr' us slots ao' x xa) (do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits))) (doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits)))
 2. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R224 ptr_base ptr' us slots ao' x xa) (?R'224 ptr_base ptr' us slots ao' x xa) (do a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od) (do a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od)
 3. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q224 ptr_base ptr' us slots ao' x xa\<rbrace> do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits)) \<lbrace>\<lambda>xb. ?R224 ptr_base ptr' us slots ao' x xa\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ptr_base ptr' us slots ao' x xa\<rbrace> doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits)) \<lbrace>\<lambda>xb. ?R'224 ptr_base ptr' us slots ao' x xa\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrakk> \<Longrightarrow> (?P224 ptr_base ptr' us slots ao' x xa and ?Q224 ptr_base ptr' us slots ao' x xa) s
 6. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'224 ptr_base ptr' us slots ao' x xa and ?Q'224 ptr_base ptr' us slots ao' x xa) s
 7. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace> do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace>, -
 8. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace>, -
 9. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 10. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> corres_underlying Id False True dc (?P229 ptr_base ptr' us slots ao' x xa) (?Q229 ptr_base ptr' us slots ao' x xa) (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits)) (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits))
 2. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R224 ptr_base ptr' us slots ao' x xa) (?R'224 ptr_base ptr' us slots ao' x xa) (do a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od) (do a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od)
 3. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q224 ptr_base ptr' us slots ao' x xa\<rbrace> do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits)) \<lbrace>\<lambda>xb. ?R224 ptr_base ptr' us slots ao' x xa\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ptr_base ptr' us slots ao' x xa\<rbrace> doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits)) \<lbrace>\<lambda>xb. ?R'224 ptr_base ptr' us slots ao' x xa\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrakk> \<Longrightarrow> (?P229 ptr_base ptr' us slots ao' x xa \<circ> machine_state and ?Q224 ptr_base ptr' us slots ao' x xa) s
 6. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?Q229 ptr_base ptr' us slots ao' x xa \<circ> ksMachineState and ?Q'224 ptr_base ptr' us slots ao' x xa) s
 7. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace> do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace>, -
 8. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace>, -
 9. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 10. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits) = clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits)
 2. \<And>ptr_base ptr' us slots ao' x xa rv. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> dc rv rv
 3. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); True\<rbrakk> \<Longrightarrow> no_fail (?Q229 ptr_base ptr' us slots ao' x xa) (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits))
 4. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R224 ptr_base ptr' us slots ao' x xa) (?R'224 ptr_base ptr' us slots ao' x xa) (do a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od) (do a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od)
 5. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q224 ptr_base ptr' us slots ao' x xa\<rbrace> do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits)) \<lbrace>\<lambda>xb. ?R224 ptr_base ptr' us slots ao' x xa\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ptr_base ptr' us slots ao' x xa\<rbrace> doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits)) \<lbrace>\<lambda>xb. ?R'224 ptr_base ptr' us slots ao' x xa\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) \<circ> machine_state and ?Q224 ptr_base ptr' us slots ao' x xa) s
 8. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?Q229 ptr_base ptr' us slots ao' x xa \<circ> ksMachineState and ?Q'224 ptr_base ptr' us slots ao' x xa) s
 9. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace> do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace>, -
 10. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace>, -
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa rv. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> dc rv rv
 2. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); True\<rbrakk> \<Longrightarrow> no_fail (?Q229 ptr_base ptr' us slots ao' x xa) (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits))
 3. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R224 ptr_base ptr' us slots ao' x xa) (?R'224 ptr_base ptr' us slots ao' x xa) (do a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od) (do a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od)
 4. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q224 ptr_base ptr' us slots ao' x xa\<rbrace> do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits)) \<lbrace>\<lambda>xb. ?R224 ptr_base ptr' us slots ao' x xa\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ptr_base ptr' us slots ao' x xa\<rbrace> doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits)) \<lbrace>\<lambda>xb. ?R'224 ptr_base ptr' us slots ao' x xa\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) \<circ> machine_state and ?Q224 ptr_base ptr' us slots ao' x xa) s
 7. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?Q229 ptr_base ptr' us slots ao' x xa \<circ> ksMachineState and ?Q'224 ptr_base ptr' us slots ao' x xa) s
 8. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace> do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace>, -
 9. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace>, -
 10. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); True\<rbrakk> \<Longrightarrow> no_fail (?Q229 ptr_base ptr' us slots ao' x xa) (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits))
 2. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R224 ptr_base ptr' us slots ao' x xa) (?R'224 ptr_base ptr' us slots ao' x xa) (do a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od) (do a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od)
 3. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q224 ptr_base ptr' us slots ao' x xa\<rbrace> do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits)) \<lbrace>\<lambda>xb. ?R224 ptr_base ptr' us slots ao' x xa\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ptr_base ptr' us slots ao' x xa\<rbrace> doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits)) \<lbrace>\<lambda>xb. ?R'224 ptr_base ptr' us slots ao' x xa\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) \<circ> machine_state and ?Q224 ptr_base ptr' us slots ao' x xa) s
 6. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?Q229 ptr_base ptr' us slots ao' x xa \<circ> ksMachineState and ?Q'224 ptr_base ptr' us slots ao' x xa) s
 7. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace> do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace>, -
 8. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace>, -
 9. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 10. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R224 ptr_base ptr' us slots ao' x xa) (?R'224 ptr_base ptr' us slots ao' x xa) (do a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od) (do a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od)
 2. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q224 ptr_base ptr' us slots ao' x xa\<rbrace> do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits)) \<lbrace>\<lambda>xb. ?R224 ptr_base ptr' us slots ao' x xa\<rbrace>
 3. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ptr_base ptr' us slots ao' x xa\<rbrace> doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits)) \<lbrace>\<lambda>xb. ?R'224 ptr_base ptr' us slots ao' x xa\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) \<circ> machine_state and ?Q224 ptr_base ptr' us slots ao' x xa) s
 5. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. is_aligned (getFreeRef ptr (xa * 2 ^ resetChunkBits)) 2) \<circ> ksMachineState and ?Q'224 ptr_base ptr' us slots ao' x xa) s
 6. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace> do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace>, -
 7. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace>, -
 8. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 9. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 10. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
A total of 14 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> corres dc (?P238 ptr_base ptr' us slots ao' x xa) (?P'238 ptr_base ptr' us slots ao' x xa) (set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot) (updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits))))
 2. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R238 ptr_base ptr' us slots ao' x xa) (?R'238 ptr_base ptr' us slots ao' x xa) preemption_point preemptionPoint
 3. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q238 ptr_base ptr' us slots ao' x xa\<rbrace> set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot \<lbrace>\<lambda>xb. ?R238 ptr_base ptr' us slots ao' x xa\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace> updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits))) \<lbrace>\<lambda>xb. ?R'238 ptr_base ptr' us slots ao' x xa\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q224 ptr_base ptr' us slots ao' x xa\<rbrace> do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits)) \<lbrace>\<lambda>xb. ?P238 ptr_base ptr' us slots ao' x xa and ?Q238 ptr_base ptr' us slots ao' x xa\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ptr_base ptr' us slots ao' x xa\<rbrace> doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits)) \<lbrace>\<lambda>xb. ?P'238 ptr_base ptr' us slots ao' x xa and ?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) \<circ> machine_state and ?Q224 ptr_base ptr' us slots ao' x xa) s
 8. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. is_aligned (getFreeRef ptr (xa * 2 ^ resetChunkBits)) 2) \<circ> ksMachineState and ?Q'224 ptr_base ptr' us slots ao' x xa) s
 9. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace> do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace>, -
 10. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace>, -
A total of 17 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> is_untyped_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits))
 2. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> free_index_of (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) = getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits))
 3. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R238 ptr_base ptr' us slots ao' x xa) (?R'238 ptr_base ptr' us slots ao' x xa) preemption_point preemptionPoint
 4. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q238 ptr_base ptr' us slots ao' x xa\<rbrace> set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot \<lbrace>\<lambda>xb. ?R238 ptr_base ptr' us slots ao' x xa\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace> updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits))) \<lbrace>\<lambda>xb. ?R'238 ptr_base ptr' us slots ao' x xa\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q224 ptr_base ptr' us slots ao' x xa\<rbrace> do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits)) \<lbrace>\<lambda>xb. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits))) slot and valid_objs and pspace_aligned and pspace_distinct and ?Q238 ptr_base ptr' us slots ao' x xa\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ptr_base ptr' us slots ao' x xa\<rbrace> doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits)) \<lbrace>\<lambda>xb. cte_wp_at' (\<lambda>_. True) (cte_map slot) and pspace_distinct' and pspace_aligned' and ?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace>
 8. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) \<circ> machine_state and ?Q224 ptr_base ptr' us slots ao' x xa) s
 9. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. is_aligned (getFreeRef ptr (xa * 2 ^ resetChunkBits)) 2) \<circ> ksMachineState and ?Q'224 ptr_base ptr' us slots ao' x xa) s
 10. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace> do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace>, -
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> free_index_of (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) = getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits))
 2. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R238 ptr_base ptr' us slots ao' x xa) (?R'238 ptr_base ptr' us slots ao' x xa) preemption_point preemptionPoint
 3. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q238 ptr_base ptr' us slots ao' x xa\<rbrace> set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot \<lbrace>\<lambda>xb. ?R238 ptr_base ptr' us slots ao' x xa\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace> updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits))) \<lbrace>\<lambda>xb. ?R'238 ptr_base ptr' us slots ao' x xa\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q224 ptr_base ptr' us slots ao' x xa\<rbrace> do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits)) \<lbrace>\<lambda>xb. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits))) slot and valid_objs and pspace_aligned and pspace_distinct and ?Q238 ptr_base ptr' us slots ao' x xa\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ptr_base ptr' us slots ao' x xa\<rbrace> doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits)) \<lbrace>\<lambda>xb. cte_wp_at' (\<lambda>_. True) (cte_map slot) and pspace_distinct' and pspace_aligned' and ?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) \<circ> machine_state and ?Q224 ptr_base ptr' us slots ao' x xa) s
 8. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. is_aligned (getFreeRef ptr (xa * 2 ^ resetChunkBits)) 2) \<circ> ksMachineState and ?Q'224 ptr_base ptr' us slots ao' x xa) s
 9. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace> do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace>, -
 10. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace>, -
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa < 2 ^ (sz - resetChunkBits) \<and> xa * 2 ^ resetChunkBits < idx\<rbrakk> \<Longrightarrow> xa * 2 ^ resetChunkBits = unat (word_of_nat xa * 2 ^ resetChunkBits)
 2. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R238 ptr_base ptr' us slots ao' x xa) (?R'238 ptr_base ptr' us slots ao' x xa) preemption_point preemptionPoint
 3. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q238 ptr_base ptr' us slots ao' x xa\<rbrace> set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot \<lbrace>\<lambda>xb. ?R238 ptr_base ptr' us slots ao' x xa\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace> updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits))) \<lbrace>\<lambda>xb. ?R'238 ptr_base ptr' us slots ao' x xa\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q224 ptr_base ptr' us slots ao' x xa\<rbrace> do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits)) \<lbrace>\<lambda>xb. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits))) slot and valid_objs and pspace_aligned and pspace_distinct and ?Q238 ptr_base ptr' us slots ao' x xa\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ptr_base ptr' us slots ao' x xa\<rbrace> doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits)) \<lbrace>\<lambda>xb. cte_wp_at' (\<lambda>_. True) (cte_map slot) and pspace_distinct' and pspace_aligned' and ?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) \<circ> machine_state and ?Q224 ptr_base ptr' us slots ao' x xa) s
 8. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. is_aligned (getFreeRef ptr (xa * 2 ^ resetChunkBits)) 2) \<circ> ksMachineState and ?Q'224 ptr_base ptr' us slots ao' x xa) s
 9. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace> do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace>, -
 10. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace>, -
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; idx \<le> 2 ^ sz; ptr \<noteq> 0; is_aligned ptr sz; resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> xa * 2 ^ resetChunkBits = unat (word_of_nat xa * 2 ^ resetChunkBits)
 2. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R238 ptr_base ptr' us slots ao' x xa) (?R'238 ptr_base ptr' us slots ao' x xa) preemption_point preemptionPoint
 3. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q238 ptr_base ptr' us slots ao' x xa\<rbrace> set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot \<lbrace>\<lambda>xb. ?R238 ptr_base ptr' us slots ao' x xa\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace> updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits))) \<lbrace>\<lambda>xb. ?R'238 ptr_base ptr' us slots ao' x xa\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q224 ptr_base ptr' us slots ao' x xa\<rbrace> do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits)) \<lbrace>\<lambda>xb. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits))) slot and valid_objs and pspace_aligned and pspace_distinct and ?Q238 ptr_base ptr' us slots ao' x xa\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ptr_base ptr' us slots ao' x xa\<rbrace> doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits)) \<lbrace>\<lambda>xb. cte_wp_at' (\<lambda>_. True) (cte_map slot) and pspace_distinct' and pspace_aligned' and ?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) \<circ> machine_state and ?Q224 ptr_base ptr' us slots ao' x xa) s
 8. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. is_aligned (getFreeRef ptr (xa * 2 ^ resetChunkBits)) 2) \<circ> ksMachineState and ?Q'224 ptr_base ptr' us slots ao' x xa) s
 9. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace> do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace>, -
 10. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace>, -
A total of 17 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; idx \<le> 2 ^ sz; ptr \<noteq> 0; is_aligned ptr sz; resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> unat (word_of_nat xa) * unat (2 ^ resetChunkBits) < 2 ^ LENGTH(32)
 2. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; idx \<le> 2 ^ sz; ptr \<noteq> 0; is_aligned ptr sz; resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> xa * 2 ^ resetChunkBits = unat (word_of_nat xa) * unat (2 ^ resetChunkBits)
 3. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R238 ptr_base ptr' us slots ao' x xa) (?R'238 ptr_base ptr' us slots ao' x xa) preemption_point preemptionPoint
 4. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q238 ptr_base ptr' us slots ao' x xa\<rbrace> set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot \<lbrace>\<lambda>xb. ?R238 ptr_base ptr' us slots ao' x xa\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace> updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits))) \<lbrace>\<lambda>xb. ?R'238 ptr_base ptr' us slots ao' x xa\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q224 ptr_base ptr' us slots ao' x xa\<rbrace> do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits)) \<lbrace>\<lambda>xb. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits))) slot and valid_objs and pspace_aligned and pspace_distinct and ?Q238 ptr_base ptr' us slots ao' x xa\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ptr_base ptr' us slots ao' x xa\<rbrace> doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits)) \<lbrace>\<lambda>xb. cte_wp_at' (\<lambda>_. True) (cte_map slot) and pspace_distinct' and pspace_aligned' and ?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace>
 8. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) \<circ> machine_state and ?Q224 ptr_base ptr' us slots ao' x xa) s
 9. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. is_aligned (getFreeRef ptr (xa * 2 ^ resetChunkBits)) 2) \<circ> ksMachineState and ?Q'224 ptr_base ptr' us slots ao' x xa) s
 10. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace> do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace>, -
A total of 18 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; idx \<le> 2 ^ sz; ptr \<noteq> 0; is_aligned ptr sz; resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> xa < 2 ^ LENGTH(32)
 2. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; idx \<le> 2 ^ sz; ptr \<noteq> 0; is_aligned ptr sz; resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> xa * unat (2 ^ resetChunkBits) < 2 ^ LENGTH(32)
 3. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; idx \<le> 2 ^ sz; ptr \<noteq> 0; is_aligned ptr sz; resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> xa * 2 ^ resetChunkBits = unat (word_of_nat xa) * unat (2 ^ resetChunkBits)
 4. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R238 ptr_base ptr' us slots ao' x xa) (?R'238 ptr_base ptr' us slots ao' x xa) preemption_point preemptionPoint
 5. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q238 ptr_base ptr' us slots ao' x xa\<rbrace> set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot \<lbrace>\<lambda>xb. ?R238 ptr_base ptr' us slots ao' x xa\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace> updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits))) \<lbrace>\<lambda>xb. ?R'238 ptr_base ptr' us slots ao' x xa\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q224 ptr_base ptr' us slots ao' x xa\<rbrace> do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits)) \<lbrace>\<lambda>xb. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits))) slot and valid_objs and pspace_aligned and pspace_distinct and ?Q238 ptr_base ptr' us slots ao' x xa\<rbrace>
 8. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ptr_base ptr' us slots ao' x xa\<rbrace> doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits)) \<lbrace>\<lambda>xb. cte_wp_at' (\<lambda>_. True) (cte_map slot) and pspace_distinct' and pspace_aligned' and ?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace>
 9. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) \<circ> machine_state and ?Q224 ptr_base ptr' us slots ao' x xa) s
 10. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. is_aligned (getFreeRef ptr (xa * 2 ^ resetChunkBits)) 2) \<circ> ksMachineState and ?Q'224 ptr_base ptr' us slots ao' x xa) s
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < 32; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; idx \<le> 2 ^ sz; ptr \<noteq> 0; is_aligned ptr sz; resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> xa < 2 ^ sz
 2. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; idx \<le> 2 ^ sz; ptr \<noteq> 0; is_aligned ptr sz; resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> xa * unat (2 ^ resetChunkBits) < 2 ^ LENGTH(32)
 3. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; idx \<le> 2 ^ sz; ptr \<noteq> 0; is_aligned ptr sz; resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> xa * 2 ^ resetChunkBits = unat (word_of_nat xa) * unat (2 ^ resetChunkBits)
 4. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R238 ptr_base ptr' us slots ao' x xa) (?R'238 ptr_base ptr' us slots ao' x xa) preemption_point preemptionPoint
 5. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q238 ptr_base ptr' us slots ao' x xa\<rbrace> set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot \<lbrace>\<lambda>xb. ?R238 ptr_base ptr' us slots ao' x xa\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace> updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits))) \<lbrace>\<lambda>xb. ?R'238 ptr_base ptr' us slots ao' x xa\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q224 ptr_base ptr' us slots ao' x xa\<rbrace> do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits)) \<lbrace>\<lambda>xb. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits))) slot and valid_objs and pspace_aligned and pspace_distinct and ?Q238 ptr_base ptr' us slots ao' x xa\<rbrace>
 8. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ptr_base ptr' us slots ao' x xa\<rbrace> doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits)) \<lbrace>\<lambda>xb. cte_wp_at' (\<lambda>_. True) (cte_map slot) and pspace_distinct' and pspace_aligned' and ?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace>
 9. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) \<circ> machine_state and ?Q224 ptr_base ptr' us slots ao' x xa) s
 10. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. is_aligned (getFreeRef ptr (xa * 2 ^ resetChunkBits)) 2) \<circ> ksMachineState and ?Q'224 ptr_base ptr' us slots ao' x xa) s
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; idx \<le> 2 ^ sz; ptr \<noteq> 0; is_aligned ptr sz; resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> xa * unat (2 ^ resetChunkBits) < 2 ^ LENGTH(32)
 2. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; idx \<le> 2 ^ sz; ptr \<noteq> 0; is_aligned ptr sz; resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> xa * 2 ^ resetChunkBits = unat (word_of_nat xa) * unat (2 ^ resetChunkBits)
 3. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R238 ptr_base ptr' us slots ao' x xa) (?R'238 ptr_base ptr' us slots ao' x xa) preemption_point preemptionPoint
 4. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q238 ptr_base ptr' us slots ao' x xa\<rbrace> set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot \<lbrace>\<lambda>xb. ?R238 ptr_base ptr' us slots ao' x xa\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace> updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits))) \<lbrace>\<lambda>xb. ?R'238 ptr_base ptr' us slots ao' x xa\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q224 ptr_base ptr' us slots ao' x xa\<rbrace> do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits)) \<lbrace>\<lambda>xb. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits))) slot and valid_objs and pspace_aligned and pspace_distinct and ?Q238 ptr_base ptr' us slots ao' x xa\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ptr_base ptr' us slots ao' x xa\<rbrace> doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits)) \<lbrace>\<lambda>xb. cte_wp_at' (\<lambda>_. True) (cte_map slot) and pspace_distinct' and pspace_aligned' and ?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace>
 8. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) \<circ> machine_state and ?Q224 ptr_base ptr' us slots ao' x xa) s
 9. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. is_aligned (getFreeRef ptr (xa * 2 ^ resetChunkBits)) 2) \<circ> ksMachineState and ?Q'224 ptr_base ptr' us slots ao' x xa) s
 10. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace> do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace>, -
A total of 18 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; idx \<le> 2 ^ sz; ptr \<noteq> 0; is_aligned ptr sz; resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> resetChunkBits < LENGTH(32)
 2. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; idx \<le> 2 ^ sz; ptr \<noteq> 0; is_aligned ptr sz; resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> xa * 2 ^ resetChunkBits < 2 ^ LENGTH(32)
 3. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; idx \<le> 2 ^ sz; ptr \<noteq> 0; is_aligned ptr sz; resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> xa * 2 ^ resetChunkBits = unat (word_of_nat xa) * unat (2 ^ resetChunkBits)
 4. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R238 ptr_base ptr' us slots ao' x xa) (?R'238 ptr_base ptr' us slots ao' x xa) preemption_point preemptionPoint
 5. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q238 ptr_base ptr' us slots ao' x xa\<rbrace> set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot \<lbrace>\<lambda>xb. ?R238 ptr_base ptr' us slots ao' x xa\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace> updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits))) \<lbrace>\<lambda>xb. ?R'238 ptr_base ptr' us slots ao' x xa\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q224 ptr_base ptr' us slots ao' x xa\<rbrace> do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits)) \<lbrace>\<lambda>xb. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits))) slot and valid_objs and pspace_aligned and pspace_distinct and ?Q238 ptr_base ptr' us slots ao' x xa\<rbrace>
 8. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ptr_base ptr' us slots ao' x xa\<rbrace> doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits)) \<lbrace>\<lambda>xb. cte_wp_at' (\<lambda>_. True) (cte_map slot) and pspace_distinct' and pspace_aligned' and ?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace>
 9. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) \<circ> machine_state and ?Q224 ptr_base ptr' us slots ao' x xa) s
 10. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. is_aligned (getFreeRef ptr (xa * 2 ^ resetChunkBits)) 2) \<circ> ksMachineState and ?Q'224 ptr_base ptr' us slots ao' x xa) s
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; idx \<le> 2 ^ sz; ptr \<noteq> 0; is_aligned ptr sz; resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> xa * 2 ^ resetChunkBits < 2 ^ LENGTH(32)
 2. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; idx \<le> 2 ^ sz; ptr \<noteq> 0; is_aligned ptr sz; resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> xa * 2 ^ resetChunkBits = unat (word_of_nat xa) * unat (2 ^ resetChunkBits)
 3. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R238 ptr_base ptr' us slots ao' x xa) (?R'238 ptr_base ptr' us slots ao' x xa) preemption_point preemptionPoint
 4. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q238 ptr_base ptr' us slots ao' x xa\<rbrace> set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot \<lbrace>\<lambda>xb. ?R238 ptr_base ptr' us slots ao' x xa\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace> updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits))) \<lbrace>\<lambda>xb. ?R'238 ptr_base ptr' us slots ao' x xa\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q224 ptr_base ptr' us slots ao' x xa\<rbrace> do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits)) \<lbrace>\<lambda>xb. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits))) slot and valid_objs and pspace_aligned and pspace_distinct and ?Q238 ptr_base ptr' us slots ao' x xa\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ptr_base ptr' us slots ao' x xa\<rbrace> doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits)) \<lbrace>\<lambda>xb. cte_wp_at' (\<lambda>_. True) (cte_map slot) and pspace_distinct' and pspace_aligned' and ?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace>
 8. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) \<circ> machine_state and ?Q224 ptr_base ptr' us slots ao' x xa) s
 9. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. is_aligned (getFreeRef ptr (xa * 2 ^ resetChunkBits)) 2) \<circ> ksMachineState and ?Q'224 ptr_base ptr' us slots ao' x xa) s
 10. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace> do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace>, -
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; idx \<le> 2 ^ sz; ptr \<noteq> 0; is_aligned ptr sz; resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> xa * 2 ^ resetChunkBits = unat (word_of_nat xa) * unat (2 ^ resetChunkBits)
 2. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R238 ptr_base ptr' us slots ao' x xa) (?R'238 ptr_base ptr' us slots ao' x xa) preemption_point preemptionPoint
 3. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q238 ptr_base ptr' us slots ao' x xa\<rbrace> set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot \<lbrace>\<lambda>xb. ?R238 ptr_base ptr' us slots ao' x xa\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace> updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits))) \<lbrace>\<lambda>xb. ?R'238 ptr_base ptr' us slots ao' x xa\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q224 ptr_base ptr' us slots ao' x xa\<rbrace> do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits)) \<lbrace>\<lambda>xb. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits))) slot and valid_objs and pspace_aligned and pspace_distinct and ?Q238 ptr_base ptr' us slots ao' x xa\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ptr_base ptr' us slots ao' x xa\<rbrace> doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits)) \<lbrace>\<lambda>xb. cte_wp_at' (\<lambda>_. True) (cte_map slot) and pspace_distinct' and pspace_aligned' and ?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) \<circ> machine_state and ?Q224 ptr_base ptr' us slots ao' x xa) s
 8. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. is_aligned (getFreeRef ptr (xa * 2 ^ resetChunkBits)) 2) \<circ> ksMachineState and ?Q'224 ptr_base ptr' us slots ao' x xa) s
 9. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace> do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace>, -
 10. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace>, -
A total of 17 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; idx \<le> 2 ^ sz; ptr \<noteq> 0; is_aligned ptr sz; resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> xa < 2 ^ LENGTH(32)
 2. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; idx \<le> 2 ^ sz; ptr \<noteq> 0; is_aligned ptr sz; resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> xa * 2 ^ resetChunkBits = xa * unat (2 ^ resetChunkBits)
 3. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R238 ptr_base ptr' us slots ao' x xa) (?R'238 ptr_base ptr' us slots ao' x xa) preemption_point preemptionPoint
 4. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q238 ptr_base ptr' us slots ao' x xa\<rbrace> set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot \<lbrace>\<lambda>xb. ?R238 ptr_base ptr' us slots ao' x xa\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace> updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits))) \<lbrace>\<lambda>xb. ?R'238 ptr_base ptr' us slots ao' x xa\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q224 ptr_base ptr' us slots ao' x xa\<rbrace> do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits)) \<lbrace>\<lambda>xb. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits))) slot and valid_objs and pspace_aligned and pspace_distinct and ?Q238 ptr_base ptr' us slots ao' x xa\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ptr_base ptr' us slots ao' x xa\<rbrace> doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits)) \<lbrace>\<lambda>xb. cte_wp_at' (\<lambda>_. True) (cte_map slot) and pspace_distinct' and pspace_aligned' and ?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace>
 8. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) \<circ> machine_state and ?Q224 ptr_base ptr' us slots ao' x xa) s
 9. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. is_aligned (getFreeRef ptr (xa * 2 ^ resetChunkBits)) 2) \<circ> ksMachineState and ?Q'224 ptr_base ptr' us slots ao' x xa) s
 10. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace> do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace>, -
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < 32; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; idx \<le> 2 ^ sz; ptr \<noteq> 0; is_aligned ptr sz; resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> xa < 2 ^ sz
 2. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; idx \<le> 2 ^ sz; ptr \<noteq> 0; is_aligned ptr sz; resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> xa * 2 ^ resetChunkBits = xa * unat (2 ^ resetChunkBits)
 3. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R238 ptr_base ptr' us slots ao' x xa) (?R'238 ptr_base ptr' us slots ao' x xa) preemption_point preemptionPoint
 4. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q238 ptr_base ptr' us slots ao' x xa\<rbrace> set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot \<lbrace>\<lambda>xb. ?R238 ptr_base ptr' us slots ao' x xa\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace> updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits))) \<lbrace>\<lambda>xb. ?R'238 ptr_base ptr' us slots ao' x xa\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q224 ptr_base ptr' us slots ao' x xa\<rbrace> do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits)) \<lbrace>\<lambda>xb. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits))) slot and valid_objs and pspace_aligned and pspace_distinct and ?Q238 ptr_base ptr' us slots ao' x xa\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ptr_base ptr' us slots ao' x xa\<rbrace> doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits)) \<lbrace>\<lambda>xb. cte_wp_at' (\<lambda>_. True) (cte_map slot) and pspace_distinct' and pspace_aligned' and ?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace>
 8. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) \<circ> machine_state and ?Q224 ptr_base ptr' us slots ao' x xa) s
 9. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. is_aligned (getFreeRef ptr (xa * 2 ^ resetChunkBits)) 2) \<circ> ksMachineState and ?Q'224 ptr_base ptr' us slots ao' x xa) s
 10. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace> do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace>, -
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; idx \<le> 2 ^ sz; ptr \<noteq> 0; is_aligned ptr sz; resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> xa * 2 ^ resetChunkBits = xa * unat (2 ^ resetChunkBits)
 2. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R238 ptr_base ptr' us slots ao' x xa) (?R'238 ptr_base ptr' us slots ao' x xa) preemption_point preemptionPoint
 3. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q238 ptr_base ptr' us slots ao' x xa\<rbrace> set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot \<lbrace>\<lambda>xb. ?R238 ptr_base ptr' us slots ao' x xa\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace> updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits))) \<lbrace>\<lambda>xb. ?R'238 ptr_base ptr' us slots ao' x xa\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q224 ptr_base ptr' us slots ao' x xa\<rbrace> do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits)) \<lbrace>\<lambda>xb. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits))) slot and valid_objs and pspace_aligned and pspace_distinct and ?Q238 ptr_base ptr' us slots ao' x xa\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ptr_base ptr' us slots ao' x xa\<rbrace> doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits)) \<lbrace>\<lambda>xb. cte_wp_at' (\<lambda>_. True) (cte_map slot) and pspace_distinct' and pspace_aligned' and ?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) \<circ> machine_state and ?Q224 ptr_base ptr' us slots ao' x xa) s
 8. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. is_aligned (getFreeRef ptr (xa * 2 ^ resetChunkBits)) 2) \<circ> ksMachineState and ?Q'224 ptr_base ptr' us slots ao' x xa) s
 9. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace> do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace>, -
 10. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace>, -
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R238 ptr_base ptr' us slots ao' x xa) (?R'238 ptr_base ptr' us slots ao' x xa) preemption_point preemptionPoint
 2. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q238 ptr_base ptr' us slots ao' x xa\<rbrace> set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot \<lbrace>\<lambda>xb. ?R238 ptr_base ptr' us slots ao' x xa\<rbrace>
 3. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace> updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits))) \<lbrace>\<lambda>xb. ?R'238 ptr_base ptr' us slots ao' x xa\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q224 ptr_base ptr' us slots ao' x xa\<rbrace> do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits)) \<lbrace>\<lambda>xb. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits))) slot and valid_objs and pspace_aligned and pspace_distinct and ?Q238 ptr_base ptr' us slots ao' x xa\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ptr_base ptr' us slots ao' x xa\<rbrace> doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits)) \<lbrace>\<lambda>xb. cte_wp_at' (\<lambda>_. True) (cte_map slot) and pspace_distinct' and pspace_aligned' and ?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) \<circ> machine_state and ?Q224 ptr_base ptr' us slots ao' x xa) s
 7. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. is_aligned (getFreeRef ptr (xa * 2 ^ resetChunkBits)) 2) \<circ> ksMachineState and ?Q'224 ptr_base ptr' us slots ao' x xa) s
 8. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace> do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace>, -
 9. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace>, -
 10. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q238 ptr_base ptr' us slots ao' x xa\<rbrace> set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot \<lbrace>\<lambda>x _. True\<rbrace>
 2. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace> updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits))) \<lbrace>\<lambda>x _. True\<rbrace>
 3. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q224 ptr_base ptr' us slots ao' x xa\<rbrace> do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits)) \<lbrace>\<lambda>xb. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits))) slot and valid_objs and pspace_aligned and pspace_distinct and ?Q238 ptr_base ptr' us slots ao' x xa\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'224 ptr_base ptr' us slots ao' x xa\<rbrace> doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits)) \<lbrace>\<lambda>xb. cte_wp_at' (\<lambda>_. True) (cte_map slot) and pspace_distinct' and pspace_aligned' and ?Q'238 ptr_base ptr' us slots ao' x xa\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) \<circ> machine_state and ?Q224 ptr_base ptr' us slots ao' x xa) s
 6. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. is_aligned (getFreeRef ptr (xa * 2 ^ resetChunkBits)) 2) \<circ> ksMachineState and ?Q'224 ptr_base ptr' us slots ao' x xa) s
 7. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace> do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace>, -
 8. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace>, -
 9. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 10. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) \<circ> machine_state and (\<lambda>s. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits))) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> True)) s
 2. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. is_aligned (getFreeRef ptr (xa * 2 ^ resetChunkBits)) 2) \<circ> ksMachineState and (\<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> True)) s
 3. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace> do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace>, -
 4. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace>, -
 5. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 6. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 8. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 9. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 10. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. is_aligned (getFreeRef ptr (xa * 2 ^ resetChunkBits)) 2) \<circ> ksMachineState and (\<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> True)) s
 2. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace> do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace>, -
 3. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace>, -
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 5. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 7. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 8. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 9. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 10. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (10 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; valid_untyped (cap.UntypedCap dev ptr sz idx) x; untyped_min_bits \<le> sz; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; is_aligned ptr sz; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> is_aligned (ptr + word_of_nat xa * 2 ^ resetChunkBits) 2
 2. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace> do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace>, -
 3. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace>, -
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 5. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 7. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 8. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 9. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 10. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (11 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; valid_untyped (cap.UntypedCap dev ptr sz idx) x; untyped_min_bits \<le> sz; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> is_aligned (word_of_nat xa * 2 ^ resetChunkBits) 2
 2. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; valid_untyped (cap.UntypedCap dev ptr sz idx) x; untyped_min_bits \<le> sz; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> 2 \<le> sz
 3. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace> do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace>, -
 4. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace>, -
 5. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 6. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 8. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 9. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 10. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; valid_untyped (cap.UntypedCap dev ptr sz idx) x; untyped_min_bits \<le> sz; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> is_aligned (word_of_nat xa * 2 ^ resetChunkBits) (?x471 ptr_base ptr' us slots ao' x xa s cte idxa)
 2. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; valid_untyped (cap.UntypedCap dev ptr sz idx) x; untyped_min_bits \<le> sz; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> 2 \<le> ?x471 ptr_base ptr' us slots ao' x xa s cte idxa
 3. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; valid_untyped (cap.UntypedCap dev ptr sz idx) x; untyped_min_bits \<le> sz; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> 2 \<le> sz
 4. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace> do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace>, -
 5. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace>, -
 6. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 7. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 8. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 9. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 10. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; valid_untyped (cap.UntypedCap dev ptr sz idx) x; untyped_min_bits \<le> sz; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> 2 \<le> resetChunkBits
 2. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; valid_untyped (cap.UntypedCap dev ptr sz idx) x; untyped_min_bits \<le> sz; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> 2 \<le> sz
 3. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace> do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace>, -
 4. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace>, -
 5. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 6. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 8. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 9. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 10. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; valid_untyped (cap.UntypedCap dev ptr sz idx) x; untyped_min_bits \<le> sz; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> 2 \<le> sz
 2. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace> do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace>, -
 3. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace>, -
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 5. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 7. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 8. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 9. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 10. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (9 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace> do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace>, -
 2. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace>, -
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 6. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 7. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 8. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 9. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (10 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?P'475 ptr_base ptr' us slots ao' x xa\<rbrace> do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrace>, -
 2. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrakk> \<Longrightarrow> ?P'475 ptr_base ptr' us slots ao' x xa s
 3. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace>, -
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 5. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 7. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 8. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 9. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 10. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (10 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa < 2 ^ (sz - resetChunkBits) \<and> xa * 2 ^ resetChunkBits < idx\<rbrakk> \<Longrightarrow> \<lbrace>?P'475 ptr_base ptr' us slots ao' x xa\<rbrace> do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od \<lbrace>\<lambda>_ s. (\<exists>y<2 ^ (sz - resetChunkBits). y * 2 ^ resetChunkBits < idx) \<longrightarrow> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s \<and> cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot s\<rbrace>, -
 2. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrakk> \<Longrightarrow> ?P'475 ptr_base ptr' us slots ao' x xa s
 3. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace>, -
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 5. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 7. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 8. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 9. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 10. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (10 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa < 2 ^ (sz - resetChunkBits) \<and> xa * 2 ^ resetChunkBits < idx\<rbrakk> \<Longrightarrow> \<lbrace>?P'475 ptr_base ptr' us slots ao' x xa\<rbrace> do a <- do_machine_op (clearMemory (ptr + (word_of_nat xa << resetChunkBits)) (2 ^ resetChunkBits));
a <- set_cap (cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits)) slot;
preemption_point
od \<lbrace>\<lambda>r s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s \<and> cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot s\<rbrace>, -
 2. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) s\<rbrakk> \<Longrightarrow> ?P'475 ptr_base ptr' us slots ao' x xa s
 3. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace>, -
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 5. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 7. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 8. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 9. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 10. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (9 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa < 2 ^ (sz - resetChunkBits) \<and> xa * 2 ^ resetChunkBits < idx; (\<exists>y<2 ^ (sz - resetChunkBits). y * 2 ^ resetChunkBits < idx) \<longrightarrow> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s \<and> cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot s\<rbrakk> \<Longrightarrow> valid_objs s \<and> s \<turnstile> cap.UntypedCap dev ptr sz (xa * 2 ^ resetChunkBits) \<and> cte_wp_at is_untyped_cap slot s \<and> pspace_aligned s \<and> pspace_distinct s \<and> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s \<and> cte_wp_at (\<lambda>a. True) slot s
 2. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace>, -
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 6. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 7. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 8. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 9. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (9 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa s cap. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots (cap_is_device cap); ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) (cap_is_device cap); x \<turnstile> cap.UntypedCap (cap_is_device cap) (obj_ref_of cap) (cap_bits cap) idx; cap_bits cap < word_bits; xa < 2 ^ (cap_bits cap - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs s; idx \<le> 2 ^ cap_bits cap; pspace_aligned s; obj_ref_of cap \<noteq> 0; pspace_distinct s; is_aligned (obj_ref_of cap) (cap_bits cap); resetChunkBits \<le> cap_bits cap; pspace_no_overlap {obj_ref_of cap..obj_ref_of cap + 2 ^ cap_bits cap - 1} s; caps_of_state s slot = Some cap; is_untyped_cap cap; ptr = obj_ref_of cap; sz = cap_bits cap; dev = cap_is_device cap\<rbrakk> \<Longrightarrow> s \<turnstile> cap.UntypedCap (cap_is_device cap) (obj_ref_of cap) (cap_bits cap) (xa * 2 ^ resetChunkBits)
 2. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace>, -
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 6. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 7. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 8. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 9. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (9 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa s cap. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots (cap_is_device cap); ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) (cap_is_device cap); x \<turnstile> cap.UntypedCap (cap_is_device cap) (obj_ref_of cap) (cap_bits cap) idx; cap_bits cap < word_bits; xa < 2 ^ (cap_bits cap - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs s; idx \<le> 2 ^ cap_bits cap; pspace_aligned s; obj_ref_of cap \<noteq> 0; pspace_distinct s; is_aligned (obj_ref_of cap) (cap_bits cap); resetChunkBits \<le> cap_bits cap; pspace_no_overlap {obj_ref_of cap..obj_ref_of cap + 2 ^ cap_bits cap - 1} s; is_untyped_cap cap; ptr = obj_ref_of cap; sz = cap_bits cap; dev = cap_is_device cap; s \<turnstile> cap\<rbrakk> \<Longrightarrow> s \<turnstile> cap.UntypedCap (cap_is_device cap) (obj_ref_of cap) (cap_bits cap) (xa * 2 ^ resetChunkBits)
 2. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace>, -
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 6. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 7. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 8. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 9. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (8 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace>, -
 2. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 5. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 6. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 8. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (9 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?P'596 ptr_base ptr' us slots ao' x xa\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrace>, -
 2. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrakk> \<Longrightarrow> ?P'596 ptr_base ptr' us slots ao' x xa s
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 6. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 7. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 8. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 9. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (9 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa < 2 ^ (sz - resetChunkBits) \<and> xa * 2 ^ resetChunkBits < idx\<rbrakk> \<Longrightarrow> \<lbrace>?P'596 ptr_base ptr' us slots ao' x xa\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>_ s. (\<exists>y<2 ^ (sz - resetChunkBits). y * 2 ^ resetChunkBits < idx) \<longrightarrow> valid_pspace' s \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> pspace_no_overlap' ptr sz s \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot) s\<rbrace>, -
 2. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrakk> \<Longrightarrow> ?P'596 ptr_base ptr' us slots ao' x xa s
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 6. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 7. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 8. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 9. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (9 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa < 2 ^ (sz - resetChunkBits) \<and> xa * 2 ^ resetChunkBits < idx\<rbrakk> \<Longrightarrow> \<lbrace>?P'596 ptr_base ptr' us slots ao' x xa\<rbrace> do a <- doMachineOp (clearMemory (getFreeRef ptr (xa * 2 ^ resetChunkBits)) (shiftL (Suc 0) resetChunkBits));
a <- updateFreeIndex (cte_map slot) (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)));
preemptionPoint
od \<lbrace>\<lambda>r s. valid_pspace' s \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> pspace_no_overlap' ptr sz s \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot) s\<rbrace>, -
 2. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])); \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) s\<rbrakk> \<Longrightarrow> ?P'596 ptr_base ptr' us slots ao' x xa s
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 6. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 7. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 8. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 9. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (8 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz; xa < 2 ^ (sz - resetChunkBits) \<and> xa * 2 ^ resetChunkBits < idx; (\<exists>y<2 ^ (sz - resetChunkBits). y * 2 ^ resetChunkBits < idx) \<longrightarrow> valid_pspace' s \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> pspace_no_overlap' ptr sz s \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot) s\<rbrakk> \<Longrightarrow> valid_pspace' s \<and> (\<exists>x xb. pspace_no_overlap' x xb s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)) \<le> 2 ^ xb \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capPtr (cteCap a) = x \<and> capBlockSize (cteCap a) = xb) (cte_map slot) s) \<and> is_aligned (word_of_nat (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)))) minUntypedSizeBits \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map slot) s \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' ptr sz s \<and> cte_wp_at' (\<lambda>a. \<exists>idx. capFreeIndex_update (\<lambda>_. getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits))) (cteCap a) = capability.UntypedCap dev ptr sz idx) (cte_map slot) s
 2. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 5. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 6. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 8. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (8 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; is_aligned ptr sz; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)) \<le> 2 ^ sz \<and> is_aligned (word_of_nat (getFreeIndex ptr (getFreeRef ptr (xa * 2 ^ resetChunkBits)))) minUntypedSizeBits
 2. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 5. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 6. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 8. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (8 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; is_aligned ptr sz; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> unat (word_of_nat xa * 2 ^ resetChunkBits) \<le> 2 ^ sz \<and> is_aligned (word_of_nat xa * 2 ^ resetChunkBits) minUntypedSizeBits
 2. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 5. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 6. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 8. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (9 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; is_aligned ptr sz; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> minUntypedSizeBits \<le> resetChunkBits
 2. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; is_aligned ptr sz; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> unat (word_of_nat xa * 2 ^ resetChunkBits) \<le> 2 ^ sz \<and> True
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 6. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 7. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 8. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 9. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (8 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; is_aligned ptr sz; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> unat (word_of_nat xa * 2 ^ resetChunkBits) \<le> 2 ^ sz \<and> True
 2. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 5. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 6. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 8. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (9 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; is_aligned ptr sz; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> unat (word_of_nat xa) * unat (2 ^ resetChunkBits) < 2 ^ LENGTH(32)
 2. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; is_aligned ptr sz; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> unat (word_of_nat xa) * unat (2 ^ resetChunkBits) \<le> 2 ^ sz \<and> True
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 6. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 7. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 8. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 9. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (10 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; is_aligned ptr sz; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> xa < 2 ^ LENGTH(32)
 2. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; is_aligned ptr sz; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> xa * unat (2 ^ resetChunkBits) < 2 ^ LENGTH(32)
 3. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; is_aligned ptr sz; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> unat (word_of_nat xa) * unat (2 ^ resetChunkBits) \<le> 2 ^ sz \<and> True
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 5. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 7. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 8. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 9. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 10. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (10 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < 32; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; is_aligned ptr sz; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> xa < 2 ^ sz
 2. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; is_aligned ptr sz; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> xa * unat (2 ^ resetChunkBits) < 2 ^ LENGTH(32)
 3. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; is_aligned ptr sz; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> unat (word_of_nat xa) * unat (2 ^ resetChunkBits) \<le> 2 ^ sz \<and> True
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 5. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 7. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 8. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 9. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 10. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (9 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; is_aligned ptr sz; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> xa * unat (2 ^ resetChunkBits) < 2 ^ LENGTH(32)
 2. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; is_aligned ptr sz; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> unat (word_of_nat xa) * unat (2 ^ resetChunkBits) \<le> 2 ^ sz \<and> True
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 6. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 7. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 8. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 9. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (10 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; is_aligned ptr sz; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> resetChunkBits < LENGTH(32)
 2. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; is_aligned ptr sz; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> xa * 2 ^ resetChunkBits < 2 ^ LENGTH(32)
 3. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; is_aligned ptr sz; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> unat (word_of_nat xa) * unat (2 ^ resetChunkBits) \<le> 2 ^ sz \<and> True
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 5. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 7. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 8. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 9. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 10. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (9 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; is_aligned ptr sz; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> xa * 2 ^ resetChunkBits < 2 ^ LENGTH(32)
 2. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; is_aligned ptr sz; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> unat (word_of_nat xa) * unat (2 ^ resetChunkBits) \<le> 2 ^ sz \<and> True
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 6. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 7. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 8. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 9. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (8 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; is_aligned ptr sz; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> unat (word_of_nat xa) * unat (2 ^ resetChunkBits) \<le> 2 ^ sz \<and> True
 2. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 5. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 6. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 8. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (9 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; is_aligned ptr sz; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> xa < 2 ^ LENGTH(32)
 2. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; is_aligned ptr sz; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> xa * unat (2 ^ resetChunkBits) \<le> 2 ^ sz \<and> True
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 6. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 7. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 8. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 9. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (9 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < 32; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; is_aligned ptr sz; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> xa < 2 ^ sz
 2. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; is_aligned ptr sz; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> xa * unat (2 ^ resetChunkBits) \<le> 2 ^ sz \<and> True
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 6. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 7. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 8. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 9. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (8 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x xa s cte idxa. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits; xa < 2 ^ (sz - resetChunkBits); xa * 2 ^ resetChunkBits < idx; valid_objs' s; idx \<le> 2 ^ sz; pspace_aligned' s; ptr \<noteq> 0; pspace_distinct' s; is_aligned ptr sz; resetChunkBits \<le> sz; no_0_obj' s; valid_mdb' s; descendants_of' (cte_map slot) (ctes_of s) = {}; pspace_no_overlap' ptr sz s; ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idxa\<rbrakk> \<Longrightarrow> xa * unat (2 ^ resetChunkBits) \<le> 2 ^ sz \<and> True
 2. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 5. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 6. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 7. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 8. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (7 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx; sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz\<rbrakk> \<Longrightarrow> rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)]) = rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])
 2. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 3. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 4. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 5. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 6. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 7. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (6 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. True) \<circ> machine_state) a) and (if dev then \<lambda>s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits c = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device c = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s else (\<lambda>a. cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = obj_ref_of (cap.UntypedCap dev ptr sz 0) \<and> cap_bits a = cap_bits (cap.UntypedCap dev ptr sz 0) \<and> cap_is_device a = cap_is_device (cap.UntypedCap dev ptr sz 0)) slot a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a)) else (\<lambda>a. \<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_objs and pspace_aligned and pspace_distinct and pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} and cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot) a) and (\<lambda>s. sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz \<and> resetChunkBits \<le> sz)\<rbrace>
 2. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 3. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 4. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 6. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (6 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>rv x. (dev \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = ptr \<and> cap_bits c = sz \<and> cap_is_device c) slot x \<and> valid_objs x \<and> pspace_aligned x \<and> pspace_distinct x) \<and> (sz < resetChunkBits \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = ptr \<and> cap_bits c = sz \<and> cap_is_device c = dev) slot x \<and> valid_objs x \<and> pspace_aligned x \<and> pspace_distinct x) \<and> (\<not> dev \<and> \<not> sz < resetChunkBits \<longrightarrow> ((\<exists>x<2 ^ (sz - resetChunkBits). x * 2 ^ resetChunkBits < idx) \<longrightarrow> valid_objs x \<and> pspace_aligned x \<and> pspace_distinct x \<and> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} x \<and> cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> \<not> cap_is_device a) slot x) \<and> sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz)\<rbrace>
 2. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 3. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 4. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 6. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (6 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q87 ptr_base ptr' us slots ao' (cap.UntypedCap dev ptr sz idx)\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>r s. (dev \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = ptr \<and> cap_bits c = sz \<and> cap_is_device c) slot s \<and> invs s \<and> invs s \<and> invs s) \<and> (sz < resetChunkBits \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = ptr \<and> cap_bits c = sz \<and> cap_is_device c = dev) slot s \<and> invs s \<and> invs s \<and> invs s) \<and> (\<not> dev \<and> \<not> sz < resetChunkBits \<longrightarrow> ((\<exists>x<2 ^ (sz - resetChunkBits). x * 2 ^ resetChunkBits < idx) \<longrightarrow> invs s \<and> invs s \<and> invs s \<and> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} s \<and> cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> \<not> cap_is_device a) slot s) \<and> sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz)\<rbrace>
 2. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 3. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and ?Q87 ptr_base ptr' us slots ao' cap) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 4. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 5. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 6. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (5 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv'. if dev \<or> sz < resetChunkBits then (\<lambda>a. \<not> dev \<longrightarrow> ((\<lambda>a. is_aligned ptr 2) \<circ> ksMachineState) a) and (if dev then \<lambda>s. cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> pspace_distinct' s \<and> pspace_aligned' s else (\<lambda>a. cte_wp_at' (\<lambda>_. True) (cte_map slot) a \<and> pspace_distinct' a \<and> pspace_aligned' a)) else (\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < idx) [0..<2 ^ (sz - resetChunkBits)])). (valid_pspace' and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and pspace_no_overlap' ptr sz and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap dev ptr sz idx) (cte_map slot)) a)\<rbrace>
 2. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and (\<lambda>a. (dev \<longrightarrow> (cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a) slot a \<and> fst slot \<notin> {ptr..ptr + 2 ^ sz - 1}) \<and> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a \<and> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a \<and> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a) \<and> (sz < resetChunkBits \<longrightarrow> (cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot a \<and> fst slot \<notin> {ptr..ptr + 2 ^ sz - 1}) \<and> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a \<and> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a \<and> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a) \<and> (\<not> dev \<and> \<not> sz < resetChunkBits \<longrightarrow> ((\<exists>x<2 ^ (sz - resetChunkBits). x * 2 ^ resetChunkBits < idx) \<longrightarrow> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a \<and> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a \<and> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a \<and> ((\<exists>dev idx. a \<turnstile> cap.UntypedCap dev ptr sz idx) \<and> pspace_aligned a \<and> valid_objs a \<and> {ptr..ptr + 2 ^ sz - 1} = {ptr..ptr + 2 ^ sz - 1}) \<and> cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> \<not> cap_is_device a) slot a \<and> fst slot \<notin> {ptr..ptr + 2 ^ sz - 1}) \<and> sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz))) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 3. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 5. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (5 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>rv' x. (dev \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) x \<and> pspace_distinct' x \<and> pspace_aligned' x) \<and> (sz < resetChunkBits \<longrightarrow> (\<not> dev \<longrightarrow> is_aligned ptr 2) \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) x \<and> pspace_distinct' x \<and> pspace_aligned' x) \<and> (\<not> dev \<and> \<not> sz < resetChunkBits \<longrightarrow> (\<exists>y<2 ^ (sz - resetChunkBits). y * 2 ^ resetChunkBits < idx) \<longrightarrow> valid_pspace' x \<and> descendants_of' (cte_map slot) (ctes_of x) = {} \<and> pspace_no_overlap' ptr sz x \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap False ptr sz idx) (cte_map slot) x)\<rbrace>
 2. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and (\<lambda>a. (dev \<longrightarrow> (cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a) slot a \<and> fst slot \<notin> {ptr..ptr + 2 ^ sz - 1}) \<and> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a \<and> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a \<and> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a) \<and> (sz < resetChunkBits \<longrightarrow> (cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot a \<and> fst slot \<notin> {ptr..ptr + 2 ^ sz - 1}) \<and> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a \<and> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a \<and> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a) \<and> (\<not> dev \<and> \<not> sz < resetChunkBits \<longrightarrow> ((\<exists>x<2 ^ (sz - resetChunkBits). x * 2 ^ resetChunkBits < idx) \<longrightarrow> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a \<and> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a \<and> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a \<and> ((\<exists>dev idx. a \<turnstile> cap.UntypedCap dev ptr sz idx) \<and> pspace_aligned a \<and> valid_objs a \<and> {ptr..ptr + 2 ^ sz - 1} = {ptr..ptr + 2 ^ sz - 1}) \<and> cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> \<not> cap_is_device a) slot a \<and> fst slot \<notin> {ptr..ptr + 2 ^ sz - 1}) \<and> sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz))) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 3. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 5. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (5 subgoals):
 1. \<And>ptr_base ptr' us slots ao' x. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; x \<turnstile> cap.UntypedCap dev ptr sz idx\<rbrakk> \<Longrightarrow> \<lbrace>?Q'83 ptr_base ptr' us slots ao' (capability.UntypedCap dev ptr sz idx)\<rbrace> deleteObjects ptr sz \<lbrace>\<lambda>r s. (dev \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> invs' s \<and> invs' s) \<and> (sz < resetChunkBits \<longrightarrow> (\<not> dev \<longrightarrow> is_aligned ptr 2) \<and> cte_wp_at' (\<lambda>_. True) (cte_map slot) s \<and> invs' s \<and> invs' s) \<and> (\<not> dev \<and> \<not> sz < resetChunkBits \<longrightarrow> (\<exists>y<2 ^ (sz - resetChunkBits). y * 2 ^ resetChunkBits < idx) \<longrightarrow> invs' s \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> pspace_no_overlap' ptr sz s \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap False ptr sz idx) (cte_map slot) s)\<rbrace>
 2. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and (\<lambda>a. (dev \<longrightarrow> (cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a) slot a \<and> fst slot \<notin> {ptr..ptr + 2 ^ sz - 1}) \<and> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a \<and> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a \<and> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a) \<and> (sz < resetChunkBits \<longrightarrow> (cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot a \<and> fst slot \<notin> {ptr..ptr + 2 ^ sz - 1}) \<and> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a \<and> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a \<and> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a) \<and> (\<not> dev \<and> \<not> sz < resetChunkBits \<longrightarrow> ((\<exists>x<2 ^ (sz - resetChunkBits). x * 2 ^ resetChunkBits < idx) \<longrightarrow> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a \<and> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a \<and> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a \<and> ((\<exists>dev idx. a \<turnstile> cap.UntypedCap dev ptr sz idx) \<and> pspace_aligned a \<and> valid_objs a \<and> {ptr..ptr + 2 ^ sz - 1} = {ptr..ptr + 2 ^ sz - 1}) \<and> cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> \<not> cap_is_device a) slot a \<and> fst slot \<notin> {ptr..ptr + 2 ^ sz - 1}) \<and> sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz))) and (\<lambda>s. cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap))\<rbrace>
 3. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and ?Q'83 ptr_base ptr' us slots ao' a\<rbrace>
 4. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 5. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (4 subgoals):
 1. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q18 ptr_base ptr' us slots ao'\<rbrace> get_cap slot \<lbrace>\<lambda>cap s. (if idx = 0 then \<lambda>a. True else (\<lambda>a. einvs a \<and> a \<turnstile> cap \<and> (\<exists>cref. cte_wp_at ((=) cap) cref a \<and> descendants_range cap cref a) \<and> untyped_children_in_mdb a \<and> if_unsafe_then_cap a \<and> valid_mdb a \<and> valid_global_refs a \<and> ct_active a) and (\<lambda>a. (dev \<longrightarrow> (cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a) slot a \<and> fst slot \<notin> {ptr..ptr + 2 ^ sz - 1}) \<and> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a \<and> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a \<and> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a) \<and> (sz < resetChunkBits \<longrightarrow> (cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot a \<and> fst slot \<notin> {ptr..ptr + 2 ^ sz - 1}) \<and> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a \<and> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a \<and> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a) \<and> (\<not> dev \<and> \<not> sz < resetChunkBits \<longrightarrow> ((\<exists>x<2 ^ (sz - resetChunkBits). x * 2 ^ resetChunkBits < idx) \<longrightarrow> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a \<and> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a \<and> ((\<lambda>s. \<exists>slot. cte_wp_at ((=) cap) slot s \<and> descendants_range cap slot s) and invs and ct_active) a \<and> ((\<exists>dev idx. a \<turnstile> cap.UntypedCap dev ptr sz idx) \<and> pspace_aligned a \<and> valid_objs a \<and> {ptr..ptr + 2 ^ sz - 1} = {ptr..ptr + 2 ^ sz - 1}) \<and> cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> \<not> cap_is_device a) slot a \<and> fst slot \<notin> {ptr..ptr + 2 ^ sz - 1}) \<and> sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz))) s \<and> cap = cap.UntypedCap dev ptr sz idx \<and> (\<exists>s. s \<turnstile> cap)\<rbrace>
 2. \<And>ptr_base ptr' us slots ao'. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'18 ptr_base ptr' us slots ao'\<rbrace> getSlotCap (cte_map slot) \<lbrace>\<lambda>a. if idx = 0 then \<lambda>a. True else (\<lambda>b. valid_cap' a b \<and> valid_pspace' b) and (\<lambda>b. (dev \<longrightarrow> (cte_wp_at' (\<lambda>a. True) (cte_map slot) b \<and> cte_map slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' a b \<and> valid_pspace' b) \<and> (cte_wp_at' (\<lambda>c. cteCap c = a) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' a (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) b \<and> (cte_wp_at' (\<lambda>c. cteCap c = a) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' a (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) b) \<and> (sz < resetChunkBits \<longrightarrow> (\<not> dev \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = a) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' a (cte_map slot) (ctes_of s)) and (\<lambda>s. is_aligned ptr 2) and K (sz < word_bits \<and> is_aligned ptr sz)) b) \<and> (cte_wp_at' (\<lambda>a. True) (cte_map slot) b \<and> cte_map slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' a b \<and> valid_pspace' b) \<and> (cte_wp_at' (\<lambda>c. cteCap c = a) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' a (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) b \<and> (cte_wp_at' (\<lambda>c. cteCap c = a) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' a (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) b) \<and> (\<not> dev \<and> \<not> sz < resetChunkBits \<longrightarrow> (\<exists>y<2 ^ (sz - resetChunkBits). y * 2 ^ resetChunkBits < idx) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = a) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' a (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) b \<and> (cte_wp_at' (\<lambda>c. cteCap c = a) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' a (cte_map slot) (ctes_of s)) and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and K (sz < word_bits \<and> is_aligned ptr sz)) b \<and> (valid_cap' a and valid_pspace') b \<and> cte_wp_at' (\<lambda>a. \<exists>idx. cteCap a = capability.UntypedCap False ptr sz idx) (cte_map slot) b \<and> cte_map slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' a b \<and> valid_pspace' b))\<rbrace>
 3. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs and (\<lambda>s. \<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) and ct_active and einvs) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) slot and ?Q18 ptr_base ptr' us slots ao') s
 4. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and ?Q'18 ptr_base ptr' us slots ao') s proof (prove)
goal (2 subgoals):
 1. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; invs s \<and> (\<exists>sza idxa. cte_wp_at (\<lambda>c. c = cap.UntypedCap dev ptr_base sza idxa \<and> cap.UntypedCap dev ptr sz idx = c) slot s \<and> range_cover ptr' sza (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots) \<and> (idxa \<le> unat (ptr' - ptr_base) \<or> ptr' = ptr_base) \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of slot (cdt s) = {} \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us) \<and> slot \<notin> set slots \<and> distinct slots \<and> (\<forall>slot\<in>set slots. cte_wp_at ((=) cap.NullCap) slot s \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s) \<and> APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')))) \<and> ct_active s \<and> invs s \<and> valid_list s \<and> valid_sched s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot s \<and> (\<forall>cap. (idx = 0 \<longrightarrow> cte_wp_at ((=) cap) slot s \<longrightarrow> cap = cap.UntypedCap dev ptr sz 0 \<and> Ex (valid_cap cap)) \<and> (0 < idx \<longrightarrow> cte_wp_at ((=) cap) slot s \<longrightarrow> s \<turnstile> cap \<and> (\<exists>a b. cte_wp_at ((=) cap) (a, b) s \<and> descendants_range cap (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> (dev \<longrightarrow> cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a) slot s \<and> (ptr \<le> fst slot \<longrightarrow> \<not> fst slot \<le> ptr + 2 ^ sz - 1) \<and> (\<exists>a b. cte_wp_at ((=) cap) (a, b) s \<and> descendants_range cap (a, b) s)) \<and> (sz < resetChunkBits \<longrightarrow> cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> cap_is_device a = dev) slot s \<and> (ptr \<le> fst slot \<longrightarrow> \<not> fst slot \<le> ptr + 2 ^ sz - 1) \<and> (\<exists>a b. cte_wp_at ((=) cap) (a, b) s \<and> descendants_range cap (a, b) s)) \<and> (\<not> dev \<and> \<not> sz < resetChunkBits \<longrightarrow> ((\<exists>x<2 ^ (sz - resetChunkBits). x * 2 ^ resetChunkBits < idx) \<longrightarrow> (\<exists>a b. cte_wp_at ((=) cap) (a, b) s \<and> descendants_range cap (a, b) s) \<and> (\<exists>dev idx. s \<turnstile> cap.UntypedCap dev ptr sz idx) \<and> pspace_aligned s \<and> valid_objs s \<and> cte_wp_at (\<lambda>a. is_untyped_cap a \<and> obj_ref_of a = ptr \<and> cap_bits a = sz \<and> \<not> cap_is_device a) slot s \<and> (ptr \<le> fst slot \<longrightarrow> \<not> fst slot \<le> ptr + 2 ^ sz - 1)) \<and> sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr \<noteq> 0 \<and> is_aligned ptr sz) \<and> cap = cap.UntypedCap dev ptr sz idx \<and> Ex (valid_cap cap)))
 2. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and (\<lambda>s. \<forall>cte. cte_wp_at' ((=) cte) (cte_map slot) s \<longrightarrow> (if idx = 0 then \<lambda>a. True else (\<lambda>a. valid_cap' (cteCap cte) a \<and> valid_pspace' a) and (\<lambda>a. (dev \<longrightarrow> (cte_wp_at' (\<lambda>a. True) (cte_map slot) a \<and> cte_map slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' (cteCap cte) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a) \<and> (sz < resetChunkBits \<longrightarrow> (\<not> dev \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and (\<lambda>s. is_aligned ptr 2) and K (sz < word_bits \<and> is_aligned ptr sz)) a) \<and> (cte_wp_at' (\<lambda>a. True) (cte_map slot) a \<and> cte_map slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' (cteCap cte) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a) \<and> (\<not> dev \<and> \<not> sz < resetChunkBits \<longrightarrow> (\<exists>y<2 ^ (sz - resetChunkBits). y * 2 ^ resetChunkBits < idx) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (valid_cap' (cteCap cte) and valid_pspace') a \<and> cte_wp_at' (\<lambda>a. \<exists>idx. cteCap a = capability.UntypedCap False ptr sz idx) (cte_map slot) a \<and> cte_map slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' (cteCap cte) a \<and> valid_pspace' a))) s)) s proof (prove)
goal (2 subgoals):
 1. \<And>ptr' us slots ao' s cap. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True (ptr' && ~~ mask sz) ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True (ptr' && ~~ mask sz) ptr' ao' us (map cte_map slots) dev; caps_of_state s slot = Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx); range_cover ptr' sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); ct_active s; invs s; valid_list s; valid_sched s\<rbrakk> \<Longrightarrow> (idx = 0 \<longrightarrow> cap = cap.UntypedCap dev (ptr' && ~~ mask sz) sz 0 \<longrightarrow> Ex (valid_cap (cap.UntypedCap dev (ptr' && ~~ mask sz) sz 0))) \<and> (0 < idx \<longrightarrow> cap = cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx \<longrightarrow> s \<turnstile> cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx \<and> (\<exists>a b. caps_of_state s (a, b) = Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx) \<and> descendants_range_in {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> (dev \<longrightarrow> (ptr' && ~~ mask sz \<le> fst slot \<longrightarrow> \<not> fst slot \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1) \<and> (\<exists>a b. caps_of_state s (a, b) = Some (cap.UntypedCap True (ptr' && ~~ mask sz) sz idx) \<and> descendants_range_in {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} (a, b) s)) \<and> (sz < resetChunkBits \<longrightarrow> (ptr' && ~~ mask sz \<le> fst slot \<longrightarrow> \<not> fst slot \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1) \<and> (\<exists>a b. caps_of_state s (a, b) = Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx) \<and> descendants_range_in {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} (a, b) s)) \<and> (\<not> dev \<and> \<not> sz < resetChunkBits \<longrightarrow> ((\<exists>x<2 ^ (sz - resetChunkBits). x * 2 ^ resetChunkBits < idx) \<longrightarrow> (\<exists>a b. caps_of_state s (a, b) = Some (cap.UntypedCap False (ptr' && ~~ mask sz) sz idx) \<and> descendants_range_in {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} (a, b) s) \<and> (\<exists>dev idx. s \<turnstile> cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx) \<and> pspace_aligned s \<and> valid_objs s \<and> (ptr' && ~~ mask sz \<le> fst slot \<longrightarrow> \<not> fst slot \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1)) \<and> sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr' && ~~ mask sz \<noteq> 0) \<and> Ex (valid_cap (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)))
 2. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and (\<lambda>s. \<forall>cte. cte_wp_at' ((=) cte) (cte_map slot) s \<longrightarrow> (if idx = 0 then \<lambda>a. True else (\<lambda>a. valid_cap' (cteCap cte) a \<and> valid_pspace' a) and (\<lambda>a. (dev \<longrightarrow> (cte_wp_at' (\<lambda>a. True) (cte_map slot) a \<and> cte_map slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' (cteCap cte) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a) \<and> (sz < resetChunkBits \<longrightarrow> (\<not> dev \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and (\<lambda>s. is_aligned ptr 2) and K (sz < word_bits \<and> is_aligned ptr sz)) a) \<and> (cte_wp_at' (\<lambda>a. True) (cte_map slot) a \<and> cte_map slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' (cteCap cte) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a) \<and> (\<not> dev \<and> \<not> sz < resetChunkBits \<longrightarrow> (\<exists>y<2 ^ (sz - resetChunkBits). y * 2 ^ resetChunkBits < idx) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (valid_cap' (cteCap cte) and valid_pspace') a \<and> cte_wp_at' (\<lambda>a. \<exists>idx. cteCap a = capability.UntypedCap False ptr sz idx) (cte_map slot) a \<and> cte_map slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' (cteCap cte) a \<and> valid_pspace' a))) s)) s proof (prove)
goal (2 subgoals):
 1. \<And>ptr' us slots ao' s cap a b. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True (ptr' && ~~ mask sz) ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True (ptr' && ~~ mask sz) ptr' ao' us (map cte_map slots) dev; caps_of_state s slot = Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx); range_cover ptr' sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); ct_active s; invs s; valid_list s; valid_sched s; slot = (a, b)\<rbrakk> \<Longrightarrow> (idx = 0 \<longrightarrow> cap = cap.UntypedCap dev (ptr' && ~~ mask sz) sz 0 \<longrightarrow> Ex (valid_cap (cap.UntypedCap dev (ptr' && ~~ mask sz) sz 0))) \<and> (0 < idx \<longrightarrow> cap = cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx \<longrightarrow> s \<turnstile> cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx \<and> (\<exists>a b. caps_of_state s (a, b) = Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx) \<and> descendants_range_in {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} (a, b) s) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> (dev \<longrightarrow> (ptr' && ~~ mask sz \<le> fst slot \<longrightarrow> \<not> fst slot \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1) \<and> (\<exists>a b. caps_of_state s (a, b) = Some (cap.UntypedCap True (ptr' && ~~ mask sz) sz idx) \<and> descendants_range_in {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} (a, b) s)) \<and> (sz < resetChunkBits \<longrightarrow> (ptr' && ~~ mask sz \<le> fst slot \<longrightarrow> \<not> fst slot \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1) \<and> (\<exists>a b. caps_of_state s (a, b) = Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx) \<and> descendants_range_in {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} (a, b) s)) \<and> (\<not> dev \<and> \<not> sz < resetChunkBits \<longrightarrow> ((\<exists>x<2 ^ (sz - resetChunkBits). x * 2 ^ resetChunkBits < idx) \<longrightarrow> (\<exists>a b. caps_of_state s (a, b) = Some (cap.UntypedCap False (ptr' && ~~ mask sz) sz idx) \<and> descendants_range_in {ptr' && ~~ mask sz..(ptr' && ~~ mask sz) + 2 ^ sz - 1} (a, b) s) \<and> (\<exists>dev idx. s \<turnstile> cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx) \<and> pspace_aligned s \<and> valid_objs s \<and> (ptr' && ~~ mask sz \<le> fst slot \<longrightarrow> \<not> fst slot \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1)) \<and> sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr' && ~~ mask sz \<noteq> 0) \<and> Ex (valid_cap (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)))
 2. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and (\<lambda>s. \<forall>cte. cte_wp_at' ((=) cte) (cte_map slot) s \<longrightarrow> (if idx = 0 then \<lambda>a. True else (\<lambda>a. valid_cap' (cteCap cte) a \<and> valid_pspace' a) and (\<lambda>a. (dev \<longrightarrow> (cte_wp_at' (\<lambda>a. True) (cte_map slot) a \<and> cte_map slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' (cteCap cte) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a) \<and> (sz < resetChunkBits \<longrightarrow> (\<not> dev \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and (\<lambda>s. is_aligned ptr 2) and K (sz < word_bits \<and> is_aligned ptr sz)) a) \<and> (cte_wp_at' (\<lambda>a. True) (cte_map slot) a \<and> cte_map slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' (cteCap cte) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a) \<and> (\<not> dev \<and> \<not> sz < resetChunkBits \<longrightarrow> (\<exists>y<2 ^ (sz - resetChunkBits). y * 2 ^ resetChunkBits < idx) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (valid_cap' (cteCap cte) and valid_pspace') a \<and> cte_wp_at' (\<lambda>a. \<exists>idx. cteCap a = capability.UntypedCap False ptr sz idx) (cte_map slot) a \<and> cte_map slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' (cteCap cte) a \<and> valid_pspace' a))) s)) s proof (prove)
goal (2 subgoals):
 1. \<And>ptr' us slots ao' s cap a b. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True (ptr' && ~~ mask sz) ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True (ptr' && ~~ mask sz) ptr' ao' us (map cte_map slots) dev; caps_of_state s slot = Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx); range_cover ptr' sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); ct_active s; invs s; valid_list s; valid_sched s; slot = (a, b)\<rbrakk> \<Longrightarrow> (idx = 0 \<longrightarrow> cap = cap.UntypedCap dev (ptr' && ~~ mask sz) sz 0 \<longrightarrow> Ex (valid_cap (cap.UntypedCap dev (ptr' && ~~ mask sz) sz 0))) \<and> (0 < idx \<longrightarrow> cap = cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx \<longrightarrow> s \<turnstile> cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx \<and> (caps_of_state s (fst slot, snd slot) = Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx) \<and> descendants_of (fst slot, snd slot) (cdt s) = {}) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> (dev \<longrightarrow> (ptr' && ~~ mask sz \<le> fst slot \<longrightarrow> \<not> fst slot \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1) \<and> caps_of_state s (fst slot, snd slot) = Some (cap.UntypedCap True (ptr' && ~~ mask sz) sz idx) \<and> descendants_of (fst slot, snd slot) (cdt s) = {}) \<and> (sz < resetChunkBits \<longrightarrow> (ptr' && ~~ mask sz \<le> fst slot \<longrightarrow> \<not> fst slot \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1) \<and> caps_of_state s (fst slot, snd slot) = Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx) \<and> descendants_of (fst slot, snd slot) (cdt s) = {}) \<and> (\<not> dev \<and> \<not> sz < resetChunkBits \<longrightarrow> ((\<exists>x<2 ^ (sz - resetChunkBits). x * 2 ^ resetChunkBits < idx) \<longrightarrow> (caps_of_state s (fst slot, snd slot) = Some (cap.UntypedCap False (ptr' && ~~ mask sz) sz idx) \<and> descendants_of (fst slot, snd slot) (cdt s) = {}) \<and> (\<exists>dev idx. s \<turnstile> cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx) \<and> pspace_aligned s \<and> valid_objs s \<and> (ptr' && ~~ mask sz \<le> fst slot \<longrightarrow> \<not> fst slot \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1)) \<and> sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr' && ~~ mask sz \<noteq> 0) \<and> Ex (valid_cap (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)))
 2. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and (\<lambda>s. \<forall>cte. cte_wp_at' ((=) cte) (cte_map slot) s \<longrightarrow> (if idx = 0 then \<lambda>a. True else (\<lambda>a. valid_cap' (cteCap cte) a \<and> valid_pspace' a) and (\<lambda>a. (dev \<longrightarrow> (cte_wp_at' (\<lambda>a. True) (cte_map slot) a \<and> cte_map slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' (cteCap cte) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a) \<and> (sz < resetChunkBits \<longrightarrow> (\<not> dev \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and (\<lambda>s. is_aligned ptr 2) and K (sz < word_bits \<and> is_aligned ptr sz)) a) \<and> (cte_wp_at' (\<lambda>a. True) (cte_map slot) a \<and> cte_map slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' (cteCap cte) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a) \<and> (\<not> dev \<and> \<not> sz < resetChunkBits \<longrightarrow> (\<exists>y<2 ^ (sz - resetChunkBits). y * 2 ^ resetChunkBits < idx) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (valid_cap' (cteCap cte) and valid_pspace') a \<and> cte_wp_at' (\<lambda>a. \<exists>idx. cteCap a = capability.UntypedCap False ptr sz idx) (cte_map slot) a \<and> cte_map slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' (cteCap cte) a \<and> valid_pspace' a))) s)) s proof (prove)
goal (2 subgoals):
 1. \<And>ptr' us slots ao' s cap a b. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True (ptr' && ~~ mask sz) ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True (ptr' && ~~ mask sz) ptr' ao' us (map cte_map slots) dev; caps_of_state s slot = Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx); range_cover ptr' sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of slot (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; slot \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); ct_active s; invs s; valid_list s; valid_sched s; slot = (a, b); s \<turnstile> cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx\<rbrakk> \<Longrightarrow> (idx = 0 \<longrightarrow> cap = cap.UntypedCap dev (ptr' && ~~ mask sz) sz 0 \<longrightarrow> Ex (valid_cap (cap.UntypedCap dev (ptr' && ~~ mask sz) sz 0))) \<and> (0 < idx \<longrightarrow> cap = cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx \<longrightarrow> s \<turnstile> cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx \<and> (caps_of_state s (fst slot, snd slot) = Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx) \<and> descendants_of (fst slot, snd slot) (cdt s) = {}) \<and> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> (dev \<longrightarrow> (ptr' && ~~ mask sz \<le> fst slot \<longrightarrow> \<not> fst slot \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1) \<and> caps_of_state s (fst slot, snd slot) = Some (cap.UntypedCap True (ptr' && ~~ mask sz) sz idx) \<and> descendants_of (fst slot, snd slot) (cdt s) = {}) \<and> (sz < resetChunkBits \<longrightarrow> (ptr' && ~~ mask sz \<le> fst slot \<longrightarrow> \<not> fst slot \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1) \<and> caps_of_state s (fst slot, snd slot) = Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx) \<and> descendants_of (fst slot, snd slot) (cdt s) = {}) \<and> (\<not> dev \<and> \<not> sz < resetChunkBits \<longrightarrow> ((\<exists>x<2 ^ (sz - resetChunkBits). x * 2 ^ resetChunkBits < idx) \<longrightarrow> (caps_of_state s (fst slot, snd slot) = Some (cap.UntypedCap False (ptr' && ~~ mask sz) sz idx) \<and> descendants_of (fst slot, snd slot) (cdt s) = {}) \<and> (\<exists>dev idx. s \<turnstile> cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx) \<and> pspace_aligned s \<and> valid_objs s \<and> (ptr' && ~~ mask sz \<le> fst slot \<longrightarrow> \<not> fst slot \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1)) \<and> sz < word_bits \<and> idx \<le> 2 ^ sz \<and> ptr' && ~~ mask sz \<noteq> 0) \<and> Ex (valid_cap (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)))
 2. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and (\<lambda>s. \<forall>cte. cte_wp_at' ((=) cte) (cte_map slot) s \<longrightarrow> (if idx = 0 then \<lambda>a. True else (\<lambda>a. valid_cap' (cteCap cte) a \<and> valid_pspace' a) and (\<lambda>a. (dev \<longrightarrow> (cte_wp_at' (\<lambda>a. True) (cte_map slot) a \<and> cte_map slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' (cteCap cte) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a) \<and> (sz < resetChunkBits \<longrightarrow> (\<not> dev \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and (\<lambda>s. is_aligned ptr 2) and K (sz < word_bits \<and> is_aligned ptr sz)) a) \<and> (cte_wp_at' (\<lambda>a. True) (cte_map slot) a \<and> cte_map slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' (cteCap cte) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a) \<and> (\<not> dev \<and> \<not> sz < resetChunkBits \<longrightarrow> (\<exists>y<2 ^ (sz - resetChunkBits). y * 2 ^ resetChunkBits < idx) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (valid_cap' (cteCap cte) and valid_pspace') a \<and> cte_wp_at' (\<lambda>a. \<exists>idx. cteCap a = capability.UntypedCap False ptr sz idx) (cte_map slot) a \<and> cte_map slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' (cteCap cte) a \<and> valid_pspace' a))) s)) s proof (prove)
goal (2 subgoals):
 1. \<And>ptr' us slots ao' s cap a b. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (a, b) True (ptr' && ~~ mask sz) ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map (a, b)) True (ptr' && ~~ mask sz) ptr' ao' us (map cte_map slots) dev; caps_of_state s (a, b) = Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx); range_cover ptr' sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of (a, b) (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; (a, b) \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); ct_active s; invs s; valid_list s; valid_sched s; slot = (a, b); sz < word_bits; valid_untyped (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx) s; untyped_min_bits \<le> sz; idx \<le> 2 ^ sz; ptr' && ~~ mask sz \<noteq> 0\<rbrakk> \<Longrightarrow> (idx = 0 \<longrightarrow> cap = cap.UntypedCap dev (ptr' && ~~ mask sz) sz 0 \<longrightarrow> Ex (valid_cap (cap.UntypedCap dev (ptr' && ~~ mask sz) sz 0))) \<and> (0 < idx \<longrightarrow> cap = cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx \<longrightarrow> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> (dev \<longrightarrow> ptr' && ~~ mask sz \<le> a \<longrightarrow> \<not> a \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1) \<and> (sz < resetChunkBits \<longrightarrow> ptr' && ~~ mask sz \<le> a \<longrightarrow> \<not> a \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1) \<and> (\<not> dev \<and> \<not> sz < resetChunkBits \<longrightarrow> (\<exists>x<2 ^ (sz - resetChunkBits). x * 2 ^ resetChunkBits < idx) \<longrightarrow> (\<exists>dev idx. valid_untyped (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx) s \<and> idx \<le> 2 ^ sz) \<and> pspace_aligned s \<and> valid_objs s \<and> (ptr' && ~~ mask sz \<le> a \<longrightarrow> \<not> a \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1)) \<and> Ex (valid_cap (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)))
 2. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and (\<lambda>s. \<forall>cte. cte_wp_at' ((=) cte) (cte_map slot) s \<longrightarrow> (if idx = 0 then \<lambda>a. True else (\<lambda>a. valid_cap' (cteCap cte) a \<and> valid_pspace' a) and (\<lambda>a. (dev \<longrightarrow> (cte_wp_at' (\<lambda>a. True) (cte_map slot) a \<and> cte_map slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' (cteCap cte) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a) \<and> (sz < resetChunkBits \<longrightarrow> (\<not> dev \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and (\<lambda>s. is_aligned ptr 2) and K (sz < word_bits \<and> is_aligned ptr sz)) a) \<and> (cte_wp_at' (\<lambda>a. True) (cte_map slot) a \<and> cte_map slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' (cteCap cte) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a) \<and> (\<not> dev \<and> \<not> sz < resetChunkBits \<longrightarrow> (\<exists>y<2 ^ (sz - resetChunkBits). y * 2 ^ resetChunkBits < idx) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (valid_cap' (cteCap cte) and valid_pspace') a \<and> cte_wp_at' (\<lambda>a. \<exists>idx. cteCap a = capability.UntypedCap False ptr sz idx) (cte_map slot) a \<and> cte_map slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' (cteCap cte) a \<and> valid_pspace' a))) s)) s proof (prove)
goal (2 subgoals):
 1. \<And>ptr' us slots ao' s cap a b. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (a, b) True (ptr' && ~~ mask sz) ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map (a, b)) True (ptr' && ~~ mask sz) ptr' ao' us (map cte_map slots) dev; caps_of_state s (a, b) = Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx); range_cover ptr' sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of (a, b) (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; (a, b) \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); ct_active s; invs s; valid_list s; valid_sched s; slot = (a, b); sz < word_bits; valid_untyped (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx) s; untyped_min_bits \<le> sz; idx \<le> 2 ^ sz; ptr' && ~~ mask sz \<noteq> 0; s \<turnstile> cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx\<rbrakk> \<Longrightarrow> (idx = 0 \<longrightarrow> cap = cap.UntypedCap dev (ptr' && ~~ mask sz) sz 0 \<longrightarrow> Ex (valid_cap (cap.UntypedCap dev (ptr' && ~~ mask sz) sz 0))) \<and> (0 < idx \<longrightarrow> cap = cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx \<longrightarrow> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> (dev \<longrightarrow> ptr' && ~~ mask sz \<le> a \<longrightarrow> \<not> a \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1) \<and> (sz < resetChunkBits \<longrightarrow> ptr' && ~~ mask sz \<le> a \<longrightarrow> \<not> a \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1) \<and> (\<not> dev \<and> \<not> sz < resetChunkBits \<longrightarrow> (\<exists>x<2 ^ (sz - resetChunkBits). x * 2 ^ resetChunkBits < idx) \<longrightarrow> (\<exists>dev idx. valid_untyped (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx) s \<and> idx \<le> 2 ^ sz) \<and> pspace_aligned s \<and> valid_objs s \<and> (ptr' && ~~ mask sz \<le> a \<longrightarrow> \<not> a \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1)) \<and> Ex (valid_cap (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)))
 2. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and (\<lambda>s. \<forall>cte. cte_wp_at' ((=) cte) (cte_map slot) s \<longrightarrow> (if idx = 0 then \<lambda>a. True else (\<lambda>a. valid_cap' (cteCap cte) a \<and> valid_pspace' a) and (\<lambda>a. (dev \<longrightarrow> (cte_wp_at' (\<lambda>a. True) (cte_map slot) a \<and> cte_map slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' (cteCap cte) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a) \<and> (sz < resetChunkBits \<longrightarrow> (\<not> dev \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and (\<lambda>s. is_aligned ptr 2) and K (sz < word_bits \<and> is_aligned ptr sz)) a) \<and> (cte_wp_at' (\<lambda>a. True) (cte_map slot) a \<and> cte_map slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' (cteCap cte) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a) \<and> (\<not> dev \<and> \<not> sz < resetChunkBits \<longrightarrow> (\<exists>y<2 ^ (sz - resetChunkBits). y * 2 ^ resetChunkBits < idx) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (valid_cap' (cteCap cte) and valid_pspace') a \<and> cte_wp_at' (\<lambda>a. \<exists>idx. cteCap a = capability.UntypedCap False ptr sz idx) (cte_map slot) a \<and> cte_map slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' (cteCap cte) a \<and> valid_pspace' a))) s)) s proof (prove)
goal (2 subgoals):
 1. \<And>ptr' us slots ao' s cap a b. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (a, b) True (ptr' && ~~ mask sz) ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map (a, b)) True (ptr' && ~~ mask sz) ptr' ao' us (map cte_map slots) dev; caps_of_state s (a, b) = Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx); range_cover ptr' sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of (a, b) (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; (a, b) \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); ct_active s; invs s; valid_list s; valid_sched s; slot = (a, b); sz < word_bits; valid_untyped (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx) s; untyped_min_bits \<le> sz; idx \<le> 2 ^ sz; ptr' && ~~ mask sz \<noteq> 0; s \<turnstile> cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx; ex_cte_cap_wp_to (appropriate_cte_cap (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)) (a, b) s\<rbrakk> \<Longrightarrow> (idx = 0 \<longrightarrow> cap = cap.UntypedCap dev (ptr' && ~~ mask sz) sz 0 \<longrightarrow> Ex (valid_cap (cap.UntypedCap dev (ptr' && ~~ mask sz) sz 0))) \<and> (0 < idx \<longrightarrow> cap = cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx \<longrightarrow> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> (dev \<longrightarrow> ptr' && ~~ mask sz \<le> a \<longrightarrow> \<not> a \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1) \<and> (sz < resetChunkBits \<longrightarrow> ptr' && ~~ mask sz \<le> a \<longrightarrow> \<not> a \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1) \<and> (\<not> dev \<and> \<not> sz < resetChunkBits \<longrightarrow> (\<exists>x<2 ^ (sz - resetChunkBits). x * 2 ^ resetChunkBits < idx) \<longrightarrow> (\<exists>dev idx. valid_untyped (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx) s \<and> idx \<le> 2 ^ sz) \<and> pspace_aligned s \<and> valid_objs s \<and> (ptr' && ~~ mask sz \<le> a \<longrightarrow> \<not> a \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1)) \<and> Ex (valid_cap (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)))
 2. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and (\<lambda>s. \<forall>cte. cte_wp_at' ((=) cte) (cte_map slot) s \<longrightarrow> (if idx = 0 then \<lambda>a. True else (\<lambda>a. valid_cap' (cteCap cte) a \<and> valid_pspace' a) and (\<lambda>a. (dev \<longrightarrow> (cte_wp_at' (\<lambda>a. True) (cte_map slot) a \<and> cte_map slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' (cteCap cte) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a) \<and> (sz < resetChunkBits \<longrightarrow> (\<not> dev \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and (\<lambda>s. is_aligned ptr 2) and K (sz < word_bits \<and> is_aligned ptr sz)) a) \<and> (cte_wp_at' (\<lambda>a. True) (cte_map slot) a \<and> cte_map slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' (cteCap cte) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a) \<and> (\<not> dev \<and> \<not> sz < resetChunkBits \<longrightarrow> (\<exists>y<2 ^ (sz - resetChunkBits). y * 2 ^ resetChunkBits < idx) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (valid_cap' (cteCap cte) and valid_pspace') a \<and> cte_wp_at' (\<lambda>a. \<exists>idx. cteCap a = capability.UntypedCap False ptr sz idx) (cte_map slot) a \<and> cte_map slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' (cteCap cte) a \<and> valid_pspace' a))) s)) s proof (prove)
goal (2 subgoals):
 1. \<And>ptr' us slots ao' s cap a b. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype (a, b) True (ptr' && ~~ mask sz) ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map (a, b)) True (ptr' && ~~ mask sz) ptr' ao' us (map cte_map slots) dev; caps_of_state s (a, b) = Some (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx); range_cover ptr' sz (obj_bits_api (APIType_map2 (Inr ao')) us) (length slots); idx \<le> unat (ptr' && mask sz) \<or> ptr' = ptr' && ~~ mask sz; ptr = ptr' && ~~ mask sz; descendants_of (a, b) (cdt s) = {}; ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> untyped_min_bits \<le> us; (a, b) \<notin> set slots; distinct slots; \<forall>slot\<in>set slots. caps_of_state s slot = Some cap.NullCap \<and> ex_cte_cap_wp_to is_cnode_cap slot s \<and> real_cte_at slot s; APIType_map2 (Inr ao') \<noteq> ArchObject ASIDPoolObj; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> is_frame_type (APIType_map2 (Inr ao')); ct_active s; invs s; valid_list s; valid_sched s; slot = (a, b); sz < word_bits; valid_untyped (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx) s; untyped_min_bits \<le> sz; idx \<le> 2 ^ sz; ptr' && ~~ mask sz \<noteq> 0; s \<turnstile> cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx; ptr' && ~~ mask sz \<le> a \<longrightarrow> \<not> a \<le> (ptr' && ~~ mask sz) + 2 ^ sz - 1\<rbrakk> \<Longrightarrow> (idx = 0 \<longrightarrow> cap = cap.UntypedCap dev (ptr' && ~~ mask sz) sz 0 \<longrightarrow> Ex (valid_cap (cap.UntypedCap dev (ptr' && ~~ mask sz) sz 0))) \<and> (0 < idx \<longrightarrow> cap = cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx \<longrightarrow> untyped_children_in_mdb s \<and> if_unsafe_then_cap s \<and> valid_mdb s \<and> valid_global_refs s \<and> (\<not> dev \<and> \<not> sz < resetChunkBits \<longrightarrow> (\<exists>x<2 ^ (sz - resetChunkBits). x * 2 ^ resetChunkBits < idx) \<longrightarrow> (\<exists>dev idx. valid_untyped (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx) s \<and> idx \<le> 2 ^ sz) \<and> pspace_aligned s \<and> valid_objs s) \<and> Ex (valid_cap (cap.UntypedCap dev (ptr' && ~~ mask sz) sz idx)))
 2. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and (\<lambda>s. \<forall>cte. cte_wp_at' ((=) cte) (cte_map slot) s \<longrightarrow> (if idx = 0 then \<lambda>a. True else (\<lambda>a. valid_cap' (cteCap cte) a \<and> valid_pspace' a) and (\<lambda>a. (dev \<longrightarrow> (cte_wp_at' (\<lambda>a. True) (cte_map slot) a \<and> cte_map slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' (cteCap cte) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a) \<and> (sz < resetChunkBits \<longrightarrow> (\<not> dev \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and (\<lambda>s. is_aligned ptr 2) and K (sz < word_bits \<and> is_aligned ptr sz)) a) \<and> (cte_wp_at' (\<lambda>a. True) (cte_map slot) a \<and> cte_map slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' (cteCap cte) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a) \<and> (\<not> dev \<and> \<not> sz < resetChunkBits \<longrightarrow> (\<exists>y<2 ^ (sz - resetChunkBits). y * 2 ^ resetChunkBits < idx) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (valid_cap' (cteCap cte) and valid_pspace') a \<and> cte_wp_at' (\<lambda>a. \<exists>idx. cteCap a = capability.UntypedCap False ptr sz idx) (cte_map slot) a \<and> cte_map slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' (cteCap cte) a \<and> valid_pspace' a))) s)) s proof (prove)
goal (1 subgoal):
 1. \<And>ptr_base ptr' us slots ao' s. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr_base ptr' (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr_base ptr' ao' us (map cte_map slots) dev; (invs' and (\<lambda>s. \<exists>sza. (\<exists>idxa. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap dev ptr_base sza idxa \<and> capability.UntypedCap dev ptr sz idx = cteCap cte) (cte_map slot) s) \<and> range_cover ptr' sza (APIType_capBits ao' us) (length slots) \<and> ptr' = ptr_base \<and> ptr' && ~~ mask sza = ptr_base \<and> descendants_of' (cte_map slot) (ctes_of s) = {} \<and> cte_map slot \<notin> cte_map ` set slots \<and> distinct (map cte_map slots) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits) \<and> (\<forall>slot\<in>set slots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map slot) s) \<and> (\<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s) \<and> sch_act_simple s \<and> slots \<noteq> [] \<and> (dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao') \<and> APIType_capBits ao' us \<le> maxUntypedSizeBits) and ct_active') s\<rbrakk> \<Longrightarrow> (pspace_distinct' and pspace_aligned' and (\<lambda>s. \<forall>cte. cte_wp_at' ((=) cte) (cte_map slot) s \<longrightarrow> (if idx = 0 then \<lambda>a. True else (\<lambda>a. valid_cap' (cteCap cte) a \<and> valid_pspace' a) and (\<lambda>a. (dev \<longrightarrow> (cte_wp_at' (\<lambda>a. True) (cte_map slot) a \<and> cte_map slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' (cteCap cte) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a) \<and> (sz < resetChunkBits \<longrightarrow> (\<not> dev \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and (\<lambda>s. is_aligned ptr 2) and K (sz < word_bits \<and> is_aligned ptr sz)) a) \<and> (cte_wp_at' (\<lambda>a. True) (cte_map slot) a \<and> cte_map slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' (cteCap cte) a \<and> valid_pspace' a) \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a) \<and> (\<not> dev \<and> \<not> sz < resetChunkBits \<longrightarrow> (\<exists>y<2 ^ (sz - resetChunkBits). y * 2 ^ resetChunkBits < idx) \<longrightarrow> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (cte_wp_at' (\<lambda>c. cteCap c = cteCap cte) (cte_map slot) and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (cteCap cte) (cte_map slot) (ctes_of s)) and (\<lambda>s. descendants_of' (cte_map slot) (ctes_of s) = {}) and K (sz < word_bits \<and> is_aligned ptr sz)) a \<and> (valid_cap' (cteCap cte) and valid_pspace') a \<and> cte_wp_at' (\<lambda>a. \<exists>idx. cteCap a = capability.UntypedCap False ptr sz idx) (cte_map slot) a \<and> cte_map slot \<notin> {ptr..ptr + 2 ^ sz - 1} \<and> valid_cap' (cteCap cte) a \<and> valid_pspace' a))) s)) s proof (prove)
goal (1 subgoal):
 1. \<And>us slots ao' s cte. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr ptr (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr ptr ao' us (map cte_map slots) dev; invs' s; ct_active' s; range_cover ptr sz (APIType_capBits ao' us) (length slots); ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idx; ptr && ~~ mask sz = ptr; descendants_of' (cte_map slot) (ctes_of s) = {}; cte_map slot \<notin> cte_map ` set slots; distinct (map cte_map slots); ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s (cte_map slot) = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; APIType_capBits ao' us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> (0 < idx \<longrightarrow> valid_cap' (capability.UntypedCap dev ptr sz idx) s \<and> valid_pspace' s \<and> (dev \<longrightarrow> (ptr \<le> cte_map slot \<longrightarrow> \<not> cte_map slot \<le> ptr + 2 ^ sz - 1) \<and> valid_cap' (capability.UntypedCap True ptr sz idx) s \<and> valid_pspace' s \<and> sz < word_bits \<and> is_aligned ptr sz) \<and> (sz < resetChunkBits \<longrightarrow> (\<not> dev \<longrightarrow> is_aligned ptr 2 \<and> sz < word_bits \<and> is_aligned ptr sz) \<and> (ptr \<le> cte_map slot \<longrightarrow> \<not> cte_map slot \<le> ptr + 2 ^ sz - 1) \<and> valid_cap' (capability.UntypedCap dev ptr sz idx) s \<and> valid_pspace' s \<and> sz < word_bits \<and> is_aligned ptr sz) \<and> (\<not> dev \<and> \<not> sz < resetChunkBits \<longrightarrow> (\<exists>y<2 ^ (sz - resetChunkBits). y * 2 ^ resetChunkBits < idx) \<longrightarrow> sz < word_bits \<and> is_aligned ptr sz \<and> sz < word_bits \<and> is_aligned ptr sz \<and> valid_cap' (capability.UntypedCap False ptr sz idx) s \<and> valid_pspace' s \<and> (ptr \<le> cte_map slot \<longrightarrow> \<not> cte_map slot \<le> ptr + 2 ^ sz - 1) \<and> valid_cap' (capability.UntypedCap False ptr sz idx) s \<and> valid_pspace' s)) proof (prove)
goal (1 subgoal):
 1. \<And>us slots ao' s cte. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr ptr (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr ptr ao' us (map cte_map slots) dev; invs' s; ct_active' s; range_cover ptr sz (APIType_capBits ao' us) (length slots); ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idx; ptr && ~~ mask sz = ptr; descendants_of' (cte_map slot) (ctes_of s) = {}; cte_map slot \<notin> cte_map ` set slots; distinct (map cte_map slots); ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s (cte_map slot) = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; APIType_capBits ao' us \<le> maxUntypedSizeBits; valid_cap' (capability.UntypedCap dev ptr sz idx) s\<rbrakk> \<Longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> (0 < idx \<longrightarrow> valid_pspace' s \<and> (dev \<longrightarrow> (ptr \<le> cte_map slot \<longrightarrow> \<not> cte_map slot \<le> ptr + 2 ^ sz - 1) \<and> valid_cap' (capability.UntypedCap True ptr sz idx) s \<and> valid_pspace' s \<and> sz < word_bits \<and> is_aligned ptr sz) \<and> (sz < resetChunkBits \<longrightarrow> (\<not> dev \<longrightarrow> is_aligned ptr 2 \<and> sz < word_bits \<and> is_aligned ptr sz) \<and> (ptr \<le> cte_map slot \<longrightarrow> \<not> cte_map slot \<le> ptr + 2 ^ sz - 1) \<and> valid_pspace' s \<and> sz < word_bits \<and> is_aligned ptr sz) \<and> (\<not> dev \<and> \<not> sz < resetChunkBits \<longrightarrow> (\<exists>y<2 ^ (sz - resetChunkBits). y * 2 ^ resetChunkBits < idx) \<longrightarrow> sz < word_bits \<and> is_aligned ptr sz \<and> sz < word_bits \<and> is_aligned ptr sz \<and> valid_cap' (capability.UntypedCap False ptr sz idx) s \<and> valid_pspace' s \<and> (ptr \<le> cte_map slot \<longrightarrow> \<not> cte_map slot \<le> ptr + 2 ^ sz - 1) \<and> valid_cap' (capability.UntypedCap False ptr sz idx) s \<and> valid_pspace' s)) proof (prove)
goal (1 subgoal):
 1. \<And>us slots ao' s cte. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr ptr (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr ptr ao' us (map cte_map slots) dev; invs' s; ct_active' s; range_cover ptr sz (APIType_capBits ao' us) (length slots); ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idx; descendants_of' (cte_map slot) (ctes_of s) = {}; cte_map slot \<notin> cte_map ` set slots; distinct (map cte_map slots); ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s (cte_map slot) = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; APIType_capBits ao' us \<le> maxUntypedSizeBits; is_aligned ptr sz; sz < word_bits; valid_untyped' dev ptr sz idx s; ptr \<noteq> 0; 4 \<le> sz; sz \<le> maxUntypedSizeBits; idx \<le> 2 ^ sz; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> (0 < idx \<longrightarrow> valid_pspace' s \<and> (dev \<longrightarrow> (ptr \<le> cte_map slot \<longrightarrow> \<not> cte_map slot \<le> ptr + 2 ^ sz - 1) \<and> valid_untyped' True ptr sz idx s \<and> valid_pspace' s) \<and> (sz < resetChunkBits \<longrightarrow> (ptr \<le> cte_map slot \<longrightarrow> \<not> cte_map slot \<le> ptr + 2 ^ sz - 1) \<and> valid_pspace' s) \<and> (\<not> dev \<and> \<not> sz < resetChunkBits \<longrightarrow> (\<exists>y<2 ^ (sz - resetChunkBits). y * 2 ^ resetChunkBits < idx) \<longrightarrow> valid_untyped' False ptr sz idx s \<and> valid_pspace' s \<and> (ptr \<le> cte_map slot \<longrightarrow> \<not> cte_map slot \<le> ptr + 2 ^ sz - 1) \<and> valid_untyped' False ptr sz idx s \<and> valid_pspace' s)) proof (prove)
goal (1 subgoal):
 1. \<And>us slots ao' s cte. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr ptr (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr ptr ao' us (map cte_map slots) dev; invs' s; ct_active' s; range_cover ptr sz (APIType_capBits ao' us) (length slots); ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idx; descendants_of' (cte_map slot) (ctes_of s) = {}; cte_map slot \<notin> cte_map ` set slots; distinct (map cte_map slots); ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s (cte_map slot) = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; APIType_capBits ao' us \<le> maxUntypedSizeBits; is_aligned ptr sz; sz < word_bits; valid_untyped' dev ptr sz idx s; ptr \<noteq> 0; 4 \<le> sz; sz \<le> maxUntypedSizeBits; idx \<le> 2 ^ sz; is_aligned (word_of_nat idx) 4; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s\<rbrakk> \<Longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> (0 < idx \<longrightarrow> valid_pspace' s \<and> (dev \<longrightarrow> (ptr \<le> cte_map slot \<longrightarrow> \<not> cte_map slot \<le> ptr + 2 ^ sz - 1) \<and> valid_untyped' True ptr sz idx s \<and> valid_pspace' s) \<and> (sz < resetChunkBits \<longrightarrow> (ptr \<le> cte_map slot \<longrightarrow> \<not> cte_map slot \<le> ptr + 2 ^ sz - 1) \<and> valid_pspace' s) \<and> (\<not> dev \<and> \<not> sz < resetChunkBits \<longrightarrow> (\<exists>y<2 ^ (sz - resetChunkBits). y * 2 ^ resetChunkBits < idx) \<longrightarrow> valid_untyped' False ptr sz idx s \<and> valid_pspace' s \<and> (ptr \<le> cte_map slot \<longrightarrow> \<not> cte_map slot \<le> ptr + 2 ^ sz - 1) \<and> valid_untyped' False ptr sz idx s \<and> valid_pspace' s)) proof (prove)
goal (1 subgoal):
 1. \<And>us slots ao' s cte. \<lbrakk>ui = Invocations_A.untyped_invocation.Retype slot True ptr ptr (APIType_map2 (Inr ao')) us slots dev; ui' = Invocations_H.untyped_invocation.Retype (cte_map slot) True ptr ptr ao' us (map cte_map slots) dev; invs' s; ct_active' s; range_cover ptr sz (APIType_capBits ao' us) (length slots); ctes_of s (cte_map slot) = Some cte; cteCap cte = capability.UntypedCap dev ptr sz idx; descendants_of' (cte_map slot) (ctes_of s) = {}; cte_map slot \<notin> cte_map ` set slots; distinct (map cte_map slots); ao' = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set slots. \<exists>cte. ctes_of s (cte_map slot) = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set slots. ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; sch_act_simple s; slots \<noteq> []; dev \<longrightarrow> ao' = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType ao'; APIType_capBits ao' us \<le> maxUntypedSizeBits; is_aligned ptr sz; sz < word_bits; valid_untyped' dev ptr sz idx s; ptr \<noteq> 0; 4 \<le> sz; sz \<le> maxUntypedSizeBits; idx \<le> 2 ^ sz; is_aligned (word_of_nat idx) 4; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map slot) s; ptr \<le> cte_map slot \<longrightarrow> \<not> cte_map slot \<le> ptr + 2 ^ sz - 1\<rbrakk> \<Longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> (0 < idx \<longrightarrow> valid_pspace' s \<and> (dev \<longrightarrow> valid_untyped' True ptr sz idx s \<and> valid_pspace' s) \<and> (sz < resetChunkBits \<longrightarrow> valid_pspace' s) \<and> (\<not> dev \<and> \<not> sz < resetChunkBits \<longrightarrow> (\<exists>y<2 ^ (sz - resetChunkBits). y * 2 ^ resetChunkBits < idx) \<longrightarrow> valid_untyped' False ptr sz idx s \<and> valid_pspace' s \<and> valid_untyped' False ptr sz idx s \<and> valid_pspace' s)) proof (prove)
goal:
No subgoals!