theory Untyped_DR

lemma reset_untyped_cap_corres:
  notes delete_objects_invs[wp del]
  shows
  "dcorres (dc \<oplus> dc) \<top> (invs and valid_etcbs and ct_active
          and cte_wp_at (\<lambda>cap. is_untyped_cap cap \<and> free_index_of cap = idx) cref
          and (\<lambda>s. descendants_of cref (cdt s) = {}))
     (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref))
     (Retype_A.reset_untyped_cap cref)" supply if_cong[cong] apply (rule dcorres_expand_pfx) apply (clarsimp simp: cte_wp_at_caps_of_state is_cap_simps) apply (simp add: Untyped_D.reset_untyped_cap_def reset_untyped_cap_def
                   liftE_bindE) apply (rule corres_guard_imp) apply (rule corres_split) apply (rule get_cap_corres; simp) apply (rule_tac F="is_untyped_cap capa \<and> cap_aligned capa
                \<and> bits_of capa > 2 \<and> free_index_of capa \<le> 2 ^ bits_of capa"
            in corres_gen_asm2) apply (simp add: whenE_def if_flip split del: if_split) apply (rule corres_if) apply (clarsimp simp: is_cap_simps free_range_of_untyped_def
                              cap_aligned_def free_index_of_def
                        simp del: word_of_nat_eq_0_iff) apply (simp add: word_unat.Rep_inject[symmetric]) apply (subst unat_of_nat_eq, erule order_le_less_trans,
          rule power_strict_increasing, simp_all add: word_bits_def bits_of_def)[1] apply (rule corres_trivial, rule corres_returnOk, simp) apply (rule_tac F="free_index_of capa \<noteq> 0" in corres_gen_asm2) apply (rule corres_split_nor) apply (rule delete_objects_dcorres) apply (clarsimp simp: is_cap_simps bits_of_def) apply (rule corres_if_rhs) apply (rule_tac x="[cap_objects (transform_cap capa)]" in select_pick_corres_asm) apply (clarsimp simp: is_cap_simps cap_aligned_def free_index_of_def) apply (rule order_less_le_trans, rule free_range_of_untyped_subset'[where a=0],
            simp_all)[1] apply (simp add: word_size word_bits_def) apply (simp add: free_range_of_untyped_def) apply (simp add: mapME_x_Nil mapME_x_Cons liftE_def bind_assoc) apply (rule corres_add_noop_lhs) apply (rule corres_split_nor) apply (rule dcorres_unless_r) apply (rule clearMemory_corres_noop[OF refl]) apply (clarsimp simp: is_cap_simps cap_aligned_def bits_of_def) apply (clarsimp simp: is_cap_simps bits_of_def free_range_of_untyped_def) apply (clarsimp simp: is_cap_simps cap_aligned_def bits_of_def) apply (rule corres_trivial, simp) apply (rule corres_split_nor) apply (rule set_cap_corres) apply (clarsimp simp: is_cap_simps bits_of_def free_range_of_untyped_def) apply simp apply (rule corres_alternate1) apply (rule corres_trivial, simp add: returnOk_def) apply (wp | simp add: unless_def)+ apply (rule_tac F="\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits)
                  \<and> (\<exists>s. s \<turnstile> capa)"
              in corres_gen_asm2) apply (rule_tac x="map (\<lambda>i. free_range_of_untyped (i * 2 ^ resetChunkBits)
                  (bits_of capa) (obj_ref_of capa)) xs" for xs
          in select_pick_corres_asm) prefer 2 apply (simp add: mapME_x_map_simp o_def) apply (rule_tac P="\<top>\<top>" and P'="\<lambda>_. valid_objs
                 and valid_etcbs and pspace_no_overlap (untyped_range capa)
                 and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref)
                 and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref"
                 in mapME_x_corres_same_xs[OF _ _ _ refl]) apply (rule corres_guard_imp) apply (rule corres_add_noop_lhs) apply (rule corres_split_nor) apply (rule clearMemory_corres_noop[OF refl]) apply (clarsimp simp add: is_cap_simps cap_aligned_def bits_of_def
                                            aligned_add_aligned is_aligned_shiftl) apply (simp add: Kernel_Config.resetChunkBits_def) apply (simp add: Kernel_Config.resetChunkBits_def word_bits_def) apply (rule corres_split) apply (rule set_cap_corres; simp) apply (clarsimp simp: is_cap_simps bits_of_def) apply (subst alternative_com) apply (rule throw_or_return_preemption_corres[where P=\<top> and P'=\<top>]) apply wp+ apply (wp hoare_vcg_all_lift hoare_vcg_const_imp_lift
                      preemption_point_inv' set_cap_no_overlap
                      update_untyped_cap_valid_objs set_cap_idle
                       | simp)+ apply (clarsimp simp: is_cap_simps bits_of_def cap_aligned_def) apply (erule pspace_no_overlap_subset) apply (rule aligned_range_offset_subset, simp_all add: is_aligned_shiftl)[1] apply (rule shiftl_less_t2n[OF word_of_nat_less]) apply simp apply (simp add: word_bits_def) apply wpsimp apply (wp hoare_vcg_all_lift hoare_vcg_const_imp_lift
                   update_untyped_cap_valid_objs set_cap_no_overlap
                   set_cap_idle preemption_point_inv'
                   set_cap_cte_wp_at
                | simp)+ apply (clarsimp simp: cte_wp_at_caps_of_state exI
                               is_cap_simps bits_of_def) apply (frule(1) cte_wp_at_valid_objs_valid_cap[OF caps_of_state_cteD]) apply (clarsimp simp: valid_cap_simps cap_aligned_def
                               valid_untyped_pspace_no_overlap
                               free_index_of_def) apply (clarsimp simp: is_cap_simps bits_of_def) apply (strengthen order_trans[OF free_range_of_untyped_subseteq'[where a=0]]
                          free_range_of_untyped_subset') apply (clarsimp simp: conj_comms) apply (clarsimp simp: filter_empty_conv bexI[where x=0]
                              last_rev hd_map hd_filter_eq
                              is_cap_simps bits_of_def cap_aligned_def
                              word_bits_def word_size exI
                              rev_map[symmetric]) apply (clarsimp simp: free_index_of_def free_range_of_untyped_def) apply (simp del: hoare_TrueI) apply wp apply (wp add: hoare_vcg_const_imp_lift get_cap_wp delete_objects_invs2
         | simp
         | strengthen invs_valid_objs invs_valid_idle
         | rule impI)+ apply (clarsimp simp: cte_wp_at_caps_of_state
                        descendants_range_def2) apply (strengthen empty_descendants_range_in
    subst[where P="\<lambda>x. descendants_of x c = {}" for c, mk_strg I _ E]
    | simp add: prod_eq_iff)+ apply (cases cref) apply (clarsimp simp: is_cap_simps bits_of_def free_index_of_def
                        ) apply (frule cte_wp_at_valid_objs_valid_cap[OF caps_of_state_cteD],
    clarsimp+) apply (clarsimp simp: valid_cap_simps) apply (frule if_unsafe_then_capD[OF caps_of_state_cteD], clarsimp+) apply (frule(1) ex_cte_cap_protects[OF _ caps_of_state_cteD _ _ order_refl],
    simp add: empty_descendants_range_in, clarsimp+) apply (auto simp: not_idle_thread_def untyped_min_bits_def
             dest!: valid_idle_has_null_cap[rotated -1],
    auto intro: caps_of_state_valid)[1] done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) (Retype_A.reset_untyped_cap cref) proof (prove)
goal (1 subgoal):
 1. dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) (Retype_A.reset_untyped_cap cref) proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>s = transform s'; True; (invs and valid_etcbs and ct_active and cte_wp_at (\<lambda>cap. Structures_A.is_untyped_cap cap \<and> free_index_of cap = idx) cref and (\<lambda>s. CSpaceAcc_A.descendants_of cref (cdt s) = {})) s'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) s) ((=) s') (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) (Retype_A.reset_untyped_cap cref) proof (prove)
goal (1 subgoal):
 1. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s')) ((=) s') (Untyped_D.reset_untyped_cap (transform_cslot_ptr cref)) (Retype_A.reset_untyped_cap cref) proof (prove)
goal (1 subgoal):
 1. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) (transform s')) ((=) s') (do cap <- KHeap_D.get_cap (transform_cslot_ptr cref);
whenE (available_range cap \<noteq> cap_objects cap) (do y <- modify (Untyped_D.detype (cap_objects cap));
select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects cap \<and> available_range cap \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects cap} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range cap r);
returnOk () \<sqinter> throw
od)
od)
od) (do cap <- CSpaceAcc_A.get_cap cref;
if free_index_of cap = 0 then returnOk () else do y <- delete_objects (obj_ref_of cap) (bits_of cap);
if is_device_untyped_cap cap \<or> bits_of cap < resetChunkBits then liftE (do y <- unless (is_device_untyped_cap cap) (do_machine_op (clearMemory (obj_ref_of cap) (2 ^ bits_of cap)));
CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap cap) (obj_ref_of cap) (bits_of cap) 0) cref
od) else mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of cap + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap cap) (obj_ref_of cap) (bits_of cap) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of cap) [0..<2 ^ (bits_of cap - resetChunkBits)]))
od
od) proof (prove)
goal (3 subgoals):
 1. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?Q18 s' dev r bits f) (?Q'18 s' dev r bits f) (do cap <- KHeap_D.get_cap (transform_cslot_ptr cref);
whenE (available_range cap \<noteq> cap_objects cap) (do y <- modify (Untyped_D.detype (cap_objects cap));
select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects cap \<and> available_range cap \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects cap} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range cap r);
returnOk () \<sqinter> throw
od)
od)
od) (do cap <- CSpaceAcc_A.get_cap cref;
if free_index_of cap = 0 then returnOk () else do y <- delete_objects (obj_ref_of cap) (bits_of cap);
if is_device_untyped_cap cap \<or> bits_of cap < resetChunkBits then liftE (do y <- unless (is_device_untyped_cap cap) (do_machine_op (clearMemory (obj_ref_of cap) (2 ^ bits_of cap)));
CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap cap) (obj_ref_of cap) (bits_of cap) 0) cref
od) else mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of cap + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap cap) (obj_ref_of cap) (bits_of cap) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of cap) [0..<2 ^ (bits_of cap - resetChunkBits)]))
od
od)
 2. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ?Q18 s' dev r bits f s
 3. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> ?Q'18 s' dev r bits f s proof (prove)
goal (6 subgoals):
 1. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> dcorres (?r'22 s' dev r bits f) (?P22 s' dev r bits f) (?P'22 s' dev r bits f) (KHeap_D.get_cap (transform_cslot_ptr cref)) (CSpaceAcc_A.get_cap cref)
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); ?r'22 s' dev r bits f cap capa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R22 s' dev r bits f cap) (?R'22 s' dev r bits f capa) (whenE (available_range cap \<noteq> cap_objects cap) (do y <- modify (Untyped_D.detype (cap_objects cap));
select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects cap \<and> available_range cap \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects cap} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range cap r);
returnOk () \<sqinter> throw
od)
od)) (if free_index_of capa = 0 then returnOk () else do y <- delete_objects (obj_ref_of capa) (bits_of capa);
if is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits then liftE (do y <- unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa)));
CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref
od) else mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))
od)
 3. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>?R22 s' dev r bits f\<rbrace>
 4. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>?R'22 s' dev r bits f\<rbrace>
 5. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> (?P22 s' dev r bits f and ?Q22 s' dev r bits f) s
 6. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (?P'22 s' dev r bits f and ?Q'22 s' dev r bits f) s proof (prove)
goal (5 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R22 s' dev r bits f cap) (?R'22 s' dev r bits f capa) (whenE (available_range cap \<noteq> cap_objects cap) (do y <- modify (Untyped_D.detype (cap_objects cap));
select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects cap \<and> available_range cap \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects cap} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range cap r);
returnOk () \<sqinter> throw
od)
od)) (if free_index_of capa = 0 then returnOk () else do y <- delete_objects (obj_ref_of capa) (bits_of capa);
if is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits then liftE (do y <- unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa)));
CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref
od) else mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))
od)
 2. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>?R22 s' dev r bits f\<rbrace>
 3. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>?R'22 s' dev r bits f\<rbrace>
 4. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 5. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (5 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R22 s' dev r bits f cap) (?P'34 s' dev r bits f capa) (whenE (available_range cap \<noteq> cap_objects cap) (do y <- modify (Untyped_D.detype (cap_objects cap));
select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects cap \<and> available_range cap \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects cap} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range cap r);
returnOk () \<sqinter> throw
od)
od)) (if free_index_of capa = 0 then returnOk () else do y <- delete_objects (obj_ref_of capa) (bits_of capa);
if is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits then liftE (do y <- unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa)));
CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref
od) else mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))
od)
 2. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>?R22 s' dev r bits f\<rbrace>
 3. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. ?P'34 s' dev r bits f capa and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 4. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 5. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (5 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R22 s' dev r bits f (transform_cap capa)) (?P'34 s' dev r bits f capa) (if available_range (transform_cap capa) = cap_objects (transform_cap capa) then returnOk () else do y <- modify (Untyped_D.detype (cap_objects (transform_cap capa)));
select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)
od) (if free_index_of capa = 0 then returnOk () else do y <- delete_objects (obj_ref_of capa) (bits_of capa);
if is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits then liftE (do y <- unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa)));
CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref
od) else mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))
od)
 2. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>?R22 s' dev r bits f\<rbrace>
 3. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. ?P'34 s' dev r bits f capa and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 4. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 5. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (7 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa\<rbrakk> \<Longrightarrow> (available_range (transform_cap capa) = cap_objects (transform_cap capa)) = (free_index_of capa = 0)
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P52 s' dev r bits f (transform_cap capa)) (?P'49 s' dev r bits f capa) (returnOk ()) (returnOk ())
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?Q50 s' dev r bits f (transform_cap capa)) (?Q'47 s' dev r bits f capa) (do y <- modify (Untyped_D.detype (cap_objects (transform_cap capa)));
select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)
od) (do y <- delete_objects (obj_ref_of capa) (bits_of capa);
if is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits then liftE (do y <- unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa)));
CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref
od) else mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))
od)
 4. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then ?P52 s' dev r bits f a else ?Q50 s' dev r bits f a\<rbrace>
 5. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then ?P'49 s' dev r bits f capa else ?Q'47 s' dev r bits f capa) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 6. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 7. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (7 subgoals):
 1. \<And>s' dev r bits deva ra bitsa fa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits idx); is_aligned ra bitsa; bitsa < word_bits; 2 < bits_of (cap.UntypedCap deva ra bitsa fa); fa \<le> 2 ^ bits_of (cap.UntypedCap deva ra bitsa fa); fa \<le> 2 ^ bitsa - Suc 0\<rbrakk> \<Longrightarrow> (word_of_nat fa = 0) = (fa = 0)
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P52 s' dev r bits f (transform_cap capa)) (?P'49 s' dev r bits f capa) (returnOk ()) (returnOk ())
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?Q50 s' dev r bits f (transform_cap capa)) (?Q'47 s' dev r bits f capa) (do y <- modify (Untyped_D.detype (cap_objects (transform_cap capa)));
select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)
od) (do y <- delete_objects (obj_ref_of capa) (bits_of capa);
if is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits then liftE (do y <- unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa)));
CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref
od) else mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))
od)
 4. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then ?P52 s' dev r bits f a else ?Q50 s' dev r bits f a\<rbrace>
 5. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then ?P'49 s' dev r bits f capa else ?Q'47 s' dev r bits f capa) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 6. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 7. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (7 subgoals):
 1. \<And>s' dev r bits deva ra bitsa fa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits idx); is_aligned ra bitsa; bitsa < word_bits; 2 < bits_of (cap.UntypedCap deva ra bitsa fa); fa \<le> 2 ^ bits_of (cap.UntypedCap deva ra bitsa fa); fa \<le> 2 ^ bitsa - Suc 0\<rbrakk> \<Longrightarrow> (unat (word_of_nat fa) = 0) = (fa = 0)
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P52 s' dev r bits f (transform_cap capa)) (?P'49 s' dev r bits f capa) (returnOk ()) (returnOk ())
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?Q50 s' dev r bits f (transform_cap capa)) (?Q'47 s' dev r bits f capa) (do y <- modify (Untyped_D.detype (cap_objects (transform_cap capa)));
select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)
od) (do y <- delete_objects (obj_ref_of capa) (bits_of capa);
if is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits then liftE (do y <- unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa)));
CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref
od) else mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))
od)
 4. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then ?P52 s' dev r bits f a else ?Q50 s' dev r bits f a\<rbrace>
 5. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then ?P'49 s' dev r bits f capa else ?Q'47 s' dev r bits f capa) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 6. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 7. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (6 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P52 s' dev r bits f (transform_cap capa)) (?P'49 s' dev r bits f capa) (returnOk ()) (returnOk ())
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?Q50 s' dev r bits f (transform_cap capa)) (?Q'47 s' dev r bits f capa) (do y <- modify (Untyped_D.detype (cap_objects (transform_cap capa)));
select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)
od) (do y <- delete_objects (obj_ref_of capa) (bits_of capa);
if is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits then liftE (do y <- unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa)));
CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref
od) else mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))
od)
 3. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then ?P52 s' dev r bits f a else ?Q50 s' dev r bits f a\<rbrace>
 4. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then ?P'49 s' dev r bits f capa else ?Q'47 s' dev r bits f capa) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 5. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 6. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (5 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?Q50 s' dev r bits f (transform_cap capa)) (?Q'47 s' dev r bits f capa) (do y <- modify (Untyped_D.detype (cap_objects (transform_cap capa)));
select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)
od) (do y <- delete_objects (obj_ref_of capa) (bits_of capa);
if is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits then liftE (do y <- unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa)));
CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref
od) else mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))
od)
 2. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else ?Q50 s' dev r bits f a\<rbrace>
 3. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else ?Q'47 s' dev r bits f capa) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 4. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 5. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (5 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?Q50 s' dev r bits f (transform_cap capa)) (?P'91 s' dev r bits f capa) (do y <- modify (Untyped_D.detype (cap_objects (transform_cap capa)));
select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)
od) (do y <- delete_objects (obj_ref_of capa) (bits_of capa);
if is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits then liftE (do y <- unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa)));
CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref
od) else mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))
od)
 2. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else ?Q50 s' dev r bits f a\<rbrace>
 3. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else ?P'91 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 4. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 5. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (8 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> dcorres dc (?P103 s' dev r bits f (transform_cap capa)) (?P'100 s' dev r bits f capa) (modify (Untyped_D.detype (cap_objects (transform_cap capa)))) (delete_objects (obj_ref_of capa) (bits_of capa))
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R92 s' dev r bits f cap capa) (?R'92 s' dev r bits f cap capa) (select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)) (if is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits then liftE (do y <- unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa)));
CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref
od) else mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])))
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x. ?R92 s' dev r bits f cap capa\<rbrace>
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x. ?R'92 s' dev r bits f cap capa\<rbrace>
 5. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else ?P103 s' dev r bits f a and ?Q101 s' dev r bits f a\<rbrace>
 6. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else ?P'100 s' dev r bits f capa and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 7. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 8. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (8 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> cap_objects (transform_cap capa) = {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1}
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R92 s' dev r bits f cap capa) (?R'92 s' dev r bits f cap capa) (select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)) (if is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits then liftE (do y <- unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa)));
CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref
od) else mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])))
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x. ?R92 s' dev r bits f cap capa\<rbrace>
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x. ?R'92 s' dev r bits f cap capa\<rbrace>
 5. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 6. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 7. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 8. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (7 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R92 s' dev r bits f cap capa) (?R'92 s' dev r bits f cap capa) (select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)) (if is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits then liftE (do y <- unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa)));
CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref
od) else mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])))
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x. ?R92 s' dev r bits f cap capa\<rbrace>
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x. ?R'92 s' dev r bits f cap capa\<rbrace>
 4. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 5. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 6. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 7. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (8 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P122 s' dev r bits f cap capa) (?Q122 s' dev r bits f cap capa) (select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)) (liftE (do y <- unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa)));
CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref
od))
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P'122 s' dev r bits f cap capa) (?Q'122 s' dev r bits f cap capa) (select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)) (mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])))
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ?P122 s' dev r bits f cap capa s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?P'122 s' dev r bits f cap capa s)\<rbrace>
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ?Q122 s' dev r bits f cap capa s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?Q'122 s' dev r bits f cap capa s)\<rbrace>
 5. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 6. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 7. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 8. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (9 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> [cap_objects (transform_cap capa)] \<in> {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)}
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P122 s' dev r bits f cap capa) (?Q122 s' dev r bits f cap capa) (mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od) [cap_objects (transform_cap capa)]) (liftE (do y <- unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa)));
CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref
od))
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P'122 s' dev r bits f cap capa) (?Q'122 s' dev r bits f cap capa) (select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)) (mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])))
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ?P122 s' dev r bits f cap capa s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?P'122 s' dev r bits f cap capa s)\<rbrace>
 5. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ?Q122 s' dev r bits f cap capa s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?Q'122 s' dev r bits f cap capa s)\<rbrace>
 6. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 7. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 8. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 9. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (9 subgoals):
 1. \<And>s' dev r bits deva ra bitsa fa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits idx); 0 < fa; deva \<or> bits_of (cap.UntypedCap deva ra bitsa fa) < resetChunkBits; is_aligned ra bitsa; bitsa < word_bits; 2 < bits_of (cap.UntypedCap deva ra bitsa fa); fa \<le> 2 ^ bits_of (cap.UntypedCap deva ra bitsa fa)\<rbrakk> \<Longrightarrow> free_range_of_untyped fa bitsa ra \<subset> {ra..ra + 2 ^ bitsa - 1}
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P122 s' dev r bits f cap capa) (?Q122 s' dev r bits f cap capa) (mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od) [cap_objects (transform_cap capa)]) (liftE (do y <- unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa)));
CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref
od))
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P'122 s' dev r bits f cap capa) (?Q'122 s' dev r bits f cap capa) (select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)) (mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])))
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ?P122 s' dev r bits f cap capa s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?P'122 s' dev r bits f cap capa s)\<rbrace>
 5. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ?Q122 s' dev r bits f cap capa s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?Q'122 s' dev r bits f cap capa s)\<rbrace>
 6. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 7. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 8. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 9. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (10 subgoals):
 1. \<And>s' dev r bits deva ra bitsa fa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits idx); 0 < fa; deva \<or> bits_of (cap.UntypedCap deva ra bitsa fa) < resetChunkBits; is_aligned ra bitsa; bitsa < word_bits; 2 < bits_of (cap.UntypedCap deva ra bitsa fa); fa \<le> 2 ^ bits_of (cap.UntypedCap deva ra bitsa fa)\<rbrakk> \<Longrightarrow> bitsa < size ra
 2. \<And>s' dev r bits deva ra bitsa fa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits idx); 0 < fa; deva \<or> bits_of (cap.UntypedCap deva ra bitsa fa) < resetChunkBits; is_aligned ra bitsa; bitsa < word_bits; 2 < bits_of (cap.UntypedCap deva ra bitsa fa); fa \<le> 2 ^ bits_of (cap.UntypedCap deva ra bitsa fa)\<rbrakk> \<Longrightarrow> free_range_of_untyped 0 bitsa ra \<subseteq> {ra..ra + 2 ^ bitsa - 1}
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P122 s' dev r bits f cap capa) (?Q122 s' dev r bits f cap capa) (mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od) [cap_objects (transform_cap capa)]) (liftE (do y <- unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa)));
CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref
od))
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P'122 s' dev r bits f cap capa) (?Q'122 s' dev r bits f cap capa) (select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)) (mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])))
 5. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ?P122 s' dev r bits f cap capa s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?P'122 s' dev r bits f cap capa s)\<rbrace>
 6. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ?Q122 s' dev r bits f cap capa s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?Q'122 s' dev r bits f cap capa s)\<rbrace>
 7. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 8. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 9. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 10. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (9 subgoals):
 1. \<And>s' dev r bits deva ra bitsa fa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits idx); 0 < fa; deva \<or> bits_of (cap.UntypedCap deva ra bitsa fa) < resetChunkBits; is_aligned ra bitsa; bitsa < word_bits; 2 < bits_of (cap.UntypedCap deva ra bitsa fa); fa \<le> 2 ^ bits_of (cap.UntypedCap deva ra bitsa fa)\<rbrakk> \<Longrightarrow> free_range_of_untyped 0 bitsa ra \<subseteq> {ra..ra + 2 ^ bitsa - 1}
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P122 s' dev r bits f cap capa) (?Q122 s' dev r bits f cap capa) (mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od) [cap_objects (transform_cap capa)]) (liftE (do y <- unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa)));
CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref
od))
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P'122 s' dev r bits f cap capa) (?Q'122 s' dev r bits f cap capa) (select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)) (mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])))
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ?P122 s' dev r bits f cap capa s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?P'122 s' dev r bits f cap capa s)\<rbrace>
 5. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ?Q122 s' dev r bits f cap capa s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?Q'122 s' dev r bits f cap capa s)\<rbrace>
 6. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 7. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 8. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 9. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (8 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P122 s' dev r bits f cap capa) (?Q122 s' dev r bits f cap capa) (mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od) [cap_objects (transform_cap capa)]) (liftE (do y <- unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa)));
CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref
od))
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P'122 s' dev r bits f cap capa) (?Q'122 s' dev r bits f cap capa) (select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)) (mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])))
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ?P122 s' dev r bits f cap capa s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?P'122 s' dev r bits f cap capa s)\<rbrace>
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ?Q122 s' dev r bits f cap capa s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?Q'122 s' dev r bits f cap capa s)\<rbrace>
 5. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 6. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 7. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 8. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (8 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P122 s' dev r bits f (transform_cap capa) capa) (?Q122 s' dev r bits f (transform_cap capa) capa) (do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (cap_objects (transform_cap capa)));
returnOk () \<sqinter> throw
od) (do x <- unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa)));
r <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref;
return (Inr ())
od)
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P'122 s' dev r bits f cap capa) (?Q'122 s' dev r bits f cap capa) (select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)) (mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])))
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ?P122 s' dev r bits f cap capa s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?P'122 s' dev r bits f cap capa s)\<rbrace>
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ?Q122 s' dev r bits f cap capa s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?Q'122 s' dev r bits f cap capa s)\<rbrace>
 5. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 6. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 7. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 8. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (8 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P122 s' dev r bits f (transform_cap capa) capa) (?Q122 s' dev r bits f (transform_cap capa) capa) (do _ <- return ();
y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (cap_objects (transform_cap capa)));
returnOk () \<sqinter> throw
od) (do x <- unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa)));
r <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref;
return (Inr ())
od)
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P'122 s' dev r bits f cap capa) (?Q'122 s' dev r bits f cap capa) (select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)) (mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])))
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ?P122 s' dev r bits f cap capa s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?P'122 s' dev r bits f cap capa s)\<rbrace>
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ?Q122 s' dev r bits f cap capa s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?Q'122 s' dev r bits f cap capa s)\<rbrace>
 5. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 6. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 7. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 8. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (11 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> dcorres dc (?P164 s' dev r bits f (transform_cap capa) capa) (?P'160 s' dev r bits f (transform_cap capa) capa) (return ()) (unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa))))
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R153 s' dev r bits f cap capa) (?R'153 s' dev r bits f cap capa) (do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (cap_objects (transform_cap capa)));
returnOk () \<sqinter> throw
od) (do r <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref;
return (Inr ())
od)
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q162 s' dev r bits f (transform_cap capa) capa\<rbrace> return () \<lbrace>\<lambda>x. ?R153 s' dev r bits f cap capa\<rbrace>
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'158 s' dev r bits f (transform_cap capa) capa\<rbrace> unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa))) \<lbrace>\<lambda>x. ?R'153 s' dev r bits f cap capa\<rbrace>
 5. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P'122 s' dev r bits f cap capa) (?Q'122 s' dev r bits f cap capa) (select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)) (mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])))
 6. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> (?P164 s' dev r bits f cap capa and ?Q162 s' dev r bits f cap capa) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?P'122 s' dev r bits f cap capa s)\<rbrace>
 7. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> (?P'160 s' dev r bits f cap capa and ?Q'158 s' dev r bits f cap capa) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?Q'122 s' dev r bits f cap capa s)\<rbrace>
 8. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 9. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 10. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits; \<not> is_device_untyped_cap capa\<rbrakk> \<Longrightarrow> dcorres dc (?P179 s' dev r bits f (transform_cap capa) capa) (?P'172 s' dev r bits f (transform_cap capa) capa) (return ()) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa)))
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits; is_device_untyped_cap capa\<rbrakk> \<Longrightarrow> dcorres dc (?Q177 s' dev r bits f (transform_cap capa) capa) (?Q'171 s' dev r bits f (transform_cap capa) capa) (return ()) (return ())
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R153 s' dev r bits f cap capa) (?R'153 s' dev r bits f cap capa) (do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (cap_objects (transform_cap capa)));
returnOk () \<sqinter> throw
od) (do r <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref;
return (Inr ())
od)
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q162 s' dev r bits f (transform_cap capa) capa\<rbrace> return () \<lbrace>\<lambda>x. ?R153 s' dev r bits f cap capa\<rbrace>
 5. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'158 s' dev r bits f (transform_cap capa) capa\<rbrace> unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa))) \<lbrace>\<lambda>x. ?R'153 s' dev r bits f cap capa\<rbrace>
 6. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P'122 s' dev r bits f cap capa) (?Q'122 s' dev r bits f cap capa) (select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)) (mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])))
 7. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> (?P179 s' dev r bits f cap capa and ?Q177 s' dev r bits f cap capa and ?Q162 s' dev r bits f cap capa) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?P'122 s' dev r bits f cap capa s)\<rbrace>
 8. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> ?P'172 s' dev r bits f cap capa a) \<and> (is_device_untyped_cap capa \<longrightarrow> ?Q'171 s' dev r bits f cap capa a)) and ?Q'158 s' dev r bits f cap capa) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?Q'122 s' dev r bits f cap capa s)\<rbrace>
 9. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 10. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits; \<not> is_device_untyped_cap capa\<rbrakk> \<Longrightarrow> is_aligned (obj_ref_of capa) (bits_of capa)
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits; \<not> is_device_untyped_cap capa\<rbrakk> \<Longrightarrow> 2 \<le> bits_of capa
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits; \<not> is_device_untyped_cap capa\<rbrakk> \<Longrightarrow> bits_of capa < word_bits
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits; is_device_untyped_cap capa\<rbrakk> \<Longrightarrow> dcorres dc (?Q177 s' dev r bits f (transform_cap capa) capa) (?Q'171 s' dev r bits f (transform_cap capa) capa) (return ()) (return ())
 5. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R153 s' dev r bits f cap capa) (?R'153 s' dev r bits f cap capa) (do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (cap_objects (transform_cap capa)));
returnOk () \<sqinter> throw
od) (do r <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref;
return (Inr ())
od)
 6. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q162 s' dev r bits f (transform_cap capa) capa\<rbrace> return () \<lbrace>\<lambda>x. ?R153 s' dev r bits f cap capa\<rbrace>
 7. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'158 s' dev r bits f (transform_cap capa) capa\<rbrace> unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa))) \<lbrace>\<lambda>x. ?R'153 s' dev r bits f cap capa\<rbrace>
 8. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P'122 s' dev r bits f cap capa) (?Q'122 s' dev r bits f cap capa) (select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)) (mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])))
 9. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and ?Q177 s' dev r bits f cap capa and ?Q162 s' dev r bits f cap capa) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?P'122 s' dev r bits f cap capa s)\<rbrace>
 10. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> ?Q'171 s' dev r bits f cap capa a)) and ?Q'158 s' dev r bits f cap capa) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?Q'122 s' dev r bits f cap capa s)\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits; \<not> is_device_untyped_cap capa\<rbrakk> \<Longrightarrow> 2 \<le> bits_of capa
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits; \<not> is_device_untyped_cap capa\<rbrakk> \<Longrightarrow> bits_of capa < word_bits
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits; is_device_untyped_cap capa\<rbrakk> \<Longrightarrow> dcorres dc (?Q177 s' dev r bits f (transform_cap capa) capa) (?Q'171 s' dev r bits f (transform_cap capa) capa) (return ()) (return ())
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R153 s' dev r bits f cap capa) (?R'153 s' dev r bits f cap capa) (do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (cap_objects (transform_cap capa)));
returnOk () \<sqinter> throw
od) (do r <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref;
return (Inr ())
od)
 5. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q162 s' dev r bits f (transform_cap capa) capa\<rbrace> return () \<lbrace>\<lambda>x. ?R153 s' dev r bits f cap capa\<rbrace>
 6. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'158 s' dev r bits f (transform_cap capa) capa\<rbrace> unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa))) \<lbrace>\<lambda>x. ?R'153 s' dev r bits f cap capa\<rbrace>
 7. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P'122 s' dev r bits f cap capa) (?Q'122 s' dev r bits f cap capa) (select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)) (mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])))
 8. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and ?Q177 s' dev r bits f cap capa and ?Q162 s' dev r bits f cap capa) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?P'122 s' dev r bits f cap capa s)\<rbrace>
 9. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> ?Q'171 s' dev r bits f cap capa a)) and ?Q'158 s' dev r bits f cap capa) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?Q'122 s' dev r bits f cap capa s)\<rbrace>
 10. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits; \<not> is_device_untyped_cap capa\<rbrakk> \<Longrightarrow> bits_of capa < word_bits
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits; is_device_untyped_cap capa\<rbrakk> \<Longrightarrow> dcorres dc (?Q177 s' dev r bits f (transform_cap capa) capa) (?Q'171 s' dev r bits f (transform_cap capa) capa) (return ()) (return ())
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R153 s' dev r bits f cap capa) (?R'153 s' dev r bits f cap capa) (do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (cap_objects (transform_cap capa)));
returnOk () \<sqinter> throw
od) (do r <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref;
return (Inr ())
od)
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q162 s' dev r bits f (transform_cap capa) capa\<rbrace> return () \<lbrace>\<lambda>x. ?R153 s' dev r bits f cap capa\<rbrace>
 5. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'158 s' dev r bits f (transform_cap capa) capa\<rbrace> unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa))) \<lbrace>\<lambda>x. ?R'153 s' dev r bits f cap capa\<rbrace>
 6. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P'122 s' dev r bits f cap capa) (?Q'122 s' dev r bits f cap capa) (select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)) (mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])))
 7. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and ?Q177 s' dev r bits f cap capa and ?Q162 s' dev r bits f cap capa) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?P'122 s' dev r bits f cap capa s)\<rbrace>
 8. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> ?Q'171 s' dev r bits f cap capa a)) and ?Q'158 s' dev r bits f cap capa) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?Q'122 s' dev r bits f cap capa s)\<rbrace>
 9. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 10. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits; is_device_untyped_cap capa\<rbrakk> \<Longrightarrow> dcorres dc (?Q177 s' dev r bits f (transform_cap capa) capa) (?Q'171 s' dev r bits f (transform_cap capa) capa) (return ()) (return ())
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R153 s' dev r bits f cap capa) (?R'153 s' dev r bits f cap capa) (do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (cap_objects (transform_cap capa)));
returnOk () \<sqinter> throw
od) (do r <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref;
return (Inr ())
od)
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q162 s' dev r bits f (transform_cap capa) capa\<rbrace> return () \<lbrace>\<lambda>x. ?R153 s' dev r bits f cap capa\<rbrace>
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'158 s' dev r bits f (transform_cap capa) capa\<rbrace> unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa))) \<lbrace>\<lambda>x. ?R'153 s' dev r bits f cap capa\<rbrace>
 5. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P'122 s' dev r bits f cap capa) (?Q'122 s' dev r bits f cap capa) (select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)) (mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])))
 6. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and ?Q177 s' dev r bits f cap capa and ?Q162 s' dev r bits f cap capa) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?P'122 s' dev r bits f cap capa s)\<rbrace>
 7. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> ?Q'171 s' dev r bits f cap capa a)) and ?Q'158 s' dev r bits f cap capa) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?Q'122 s' dev r bits f cap capa s)\<rbrace>
 8. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 9. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 10. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R153 s' dev r bits f cap capa) (?R'153 s' dev r bits f cap capa) (do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (cap_objects (transform_cap capa)));
returnOk () \<sqinter> throw
od) (do r <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref;
return (Inr ())
od)
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q162 s' dev r bits f (transform_cap capa) capa\<rbrace> return () \<lbrace>\<lambda>x. ?R153 s' dev r bits f cap capa\<rbrace>
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'158 s' dev r bits f (transform_cap capa) capa\<rbrace> unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa))) \<lbrace>\<lambda>x. ?R'153 s' dev r bits f cap capa\<rbrace>
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P'122 s' dev r bits f cap capa) (?Q'122 s' dev r bits f cap capa) (select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)) (mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])))
 5. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ?Q162 s' dev r bits f cap capa) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?P'122 s' dev r bits f cap capa s)\<rbrace>
 6. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and ?Q'158 s' dev r bits f cap capa) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?Q'122 s' dev r bits f cap capa s)\<rbrace>
 7. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 8. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 9. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 10. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (13 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> dcorres dc (?P214 s' dev r bits f cap capa) (?P'214 s' dev r bits f cap capa) (KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (cap_objects (transform_cap capa)))) (CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref)
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R214 s' dev r bits f cap capa) (?R'214 s' dev r bits f cap capa) (returnOk () \<sqinter> throw) (return (Inr ()))
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q214 s' dev r bits f cap capa\<rbrace> KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x. ?R214 s' dev r bits f cap capa\<rbrace>
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'214 s' dev r bits f cap capa\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref \<lbrace>\<lambda>x. ?R'214 s' dev r bits f cap capa\<rbrace>
 5. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q162 s' dev r bits f (transform_cap capa) capa\<rbrace> return () \<lbrace>\<lambda>x. ?P214 s' dev r bits f cap capa and ?Q214 s' dev r bits f cap capa\<rbrace>
 6. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'158 s' dev r bits f (transform_cap capa) capa\<rbrace> unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa))) \<lbrace>\<lambda>x. ?P'214 s' dev r bits f cap capa and ?Q'214 s' dev r bits f cap capa\<rbrace>
 7. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P'122 s' dev r bits f cap capa) (?Q'122 s' dev r bits f cap capa) (select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)) (mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])))
 8. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ?Q162 s' dev r bits f cap capa) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?P'122 s' dev r bits f cap capa s)\<rbrace>
 9. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and ?Q'158 s' dev r bits f cap capa) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?Q'122 s' dev r bits f cap capa s)\<rbrace>
 10. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> set_available_range (transform_cap capa) (cap_objects (transform_cap capa)) = transform_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0)
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> transform_cslot_ptr cref = transform_cslot_ptr cref
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R214 s' dev r bits f cap capa) (?R'214 s' dev r bits f cap capa) (returnOk () \<sqinter> throw) (return (Inr ()))
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q214 s' dev r bits f cap capa\<rbrace> KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x. ?R214 s' dev r bits f cap capa\<rbrace>
 5. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'214 s' dev r bits f cap capa\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref \<lbrace>\<lambda>x. ?R'214 s' dev r bits f cap capa\<rbrace>
 6. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q162 s' dev r bits f (transform_cap capa) capa\<rbrace> return () \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q214 s' dev r bits f cap capa\<rbrace>
 7. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'158 s' dev r bits f (transform_cap capa) capa\<rbrace> unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa))) \<lbrace>\<lambda>x. (\<lambda>s. valid_idle s \<and> fst cref \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'214 s' dev r bits f cap capa\<rbrace>
 8. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P'122 s' dev r bits f cap capa) (?Q'122 s' dev r bits f cap capa) (select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)) (mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])))
 9. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ?Q162 s' dev r bits f cap capa) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?P'122 s' dev r bits f cap capa s)\<rbrace>
 10. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and ?Q'158 s' dev r bits f cap capa) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?Q'122 s' dev r bits f cap capa s)\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> transform_cslot_ptr cref = transform_cslot_ptr cref
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R214 s' dev r bits f cap capa) (?R'214 s' dev r bits f cap capa) (returnOk () \<sqinter> throw) (return (Inr ()))
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q214 s' dev r bits f cap capa\<rbrace> KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x. ?R214 s' dev r bits f cap capa\<rbrace>
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'214 s' dev r bits f cap capa\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref \<lbrace>\<lambda>x. ?R'214 s' dev r bits f cap capa\<rbrace>
 5. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q162 s' dev r bits f (transform_cap capa) capa\<rbrace> return () \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q214 s' dev r bits f cap capa\<rbrace>
 6. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'158 s' dev r bits f (transform_cap capa) capa\<rbrace> unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa))) \<lbrace>\<lambda>x. (\<lambda>s. valid_idle s \<and> fst cref \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'214 s' dev r bits f cap capa\<rbrace>
 7. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P'122 s' dev r bits f cap capa) (?Q'122 s' dev r bits f cap capa) (select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)) (mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])))
 8. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ?Q162 s' dev r bits f cap capa) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?P'122 s' dev r bits f cap capa s)\<rbrace>
 9. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and ?Q'158 s' dev r bits f cap capa) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?Q'122 s' dev r bits f cap capa s)\<rbrace>
 10. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R214 s' dev r bits f cap capa) (?R'214 s' dev r bits f cap capa) (returnOk () \<sqinter> throw) (return (Inr ()))
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q214 s' dev r bits f cap capa\<rbrace> KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x. ?R214 s' dev r bits f cap capa\<rbrace>
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'214 s' dev r bits f cap capa\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref \<lbrace>\<lambda>x. ?R'214 s' dev r bits f cap capa\<rbrace>
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q162 s' dev r bits f (transform_cap capa) capa\<rbrace> return () \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q214 s' dev r bits f cap capa\<rbrace>
 5. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'158 s' dev r bits f (transform_cap capa) capa\<rbrace> unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa))) \<lbrace>\<lambda>x. (\<lambda>s. valid_idle s \<and> fst cref \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'214 s' dev r bits f cap capa\<rbrace>
 6. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P'122 s' dev r bits f cap capa) (?Q'122 s' dev r bits f cap capa) (select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)) (mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])))
 7. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ?Q162 s' dev r bits f cap capa) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?P'122 s' dev r bits f cap capa s)\<rbrace>
 8. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and ?Q'158 s' dev r bits f cap capa) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?Q'122 s' dev r bits f cap capa s)\<rbrace>
 9. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 10. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R214 s' dev r bits f cap capa) (?R'214 s' dev r bits f cap capa) (returnOk ()) (return (Inr ()))
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q214 s' dev r bits f cap capa\<rbrace> KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x. ?R214 s' dev r bits f cap capa\<rbrace>
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'214 s' dev r bits f cap capa\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref \<lbrace>\<lambda>x. ?R'214 s' dev r bits f cap capa\<rbrace>
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q162 s' dev r bits f (transform_cap capa) capa\<rbrace> return () \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q214 s' dev r bits f cap capa\<rbrace>
 5. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'158 s' dev r bits f (transform_cap capa) capa\<rbrace> unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa))) \<lbrace>\<lambda>x. (\<lambda>s. valid_idle s \<and> fst cref \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'214 s' dev r bits f cap capa\<rbrace>
 6. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P'122 s' dev r bits f cap capa) (?Q'122 s' dev r bits f cap capa) (select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)) (mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])))
 7. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ?Q162 s' dev r bits f cap capa) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?P'122 s' dev r bits f cap capa s)\<rbrace>
 8. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and ?Q'158 s' dev r bits f cap capa) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?Q'122 s' dev r bits f cap capa s)\<rbrace>
 9. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 10. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q214 s' dev r bits f cap capa\<rbrace> KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x _. True\<rbrace>
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'214 s' dev r bits f cap capa\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) 0) cref \<lbrace>\<lambda>x _. True\<rbrace>
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q162 s' dev r bits f (transform_cap capa) capa\<rbrace> return () \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q214 s' dev r bits f cap capa\<rbrace>
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'158 s' dev r bits f (transform_cap capa) capa\<rbrace> unless (is_device_untyped_cap capa) (do_machine_op (clearMemory (obj_ref_of capa) (2 ^ bits_of capa))) \<lbrace>\<lambda>x. (\<lambda>s. valid_idle s \<and> fst cref \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'214 s' dev r bits f cap capa\<rbrace>
 5. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P'122 s' dev r bits f cap capa) (?Q'122 s' dev r bits f cap capa) (select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)) (mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap (is_device_untyped_cap capa) (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])))
 6. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ?Q162 s' dev r bits f cap capa) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?P'122 s' dev r bits f cap capa s)\<rbrace>
 7. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and ?Q'158 s' dev r bits f cap capa) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?Q'122 s' dev r bits f cap capa s)\<rbrace>
 8. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 9. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 10. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
A total of 11 subgoals... proof (prove)
goal (7 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P'122 s' dev r bits f (transform_cap capa) capa) (?Q'122 s' dev r bits f (transform_cap capa) capa) (select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)) (mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])))
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>s. True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?P'122 s' dev r bits f cap capa s)\<rbrace>
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and (if is_device_untyped_cap capa then \<lambda>s. valid_idle s \<and> (fst cref \<noteq> idle_thread s \<and> valid_etcbs s) \<and> True else (\<lambda>a. valid_idle a \<and> fst cref \<noteq> idle_thread a \<and> valid_etcbs a \<and> True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?Q'122 s' dev r bits f cap capa s)\<rbrace>
 4. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 5. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 6. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 7. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (7 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P'122 s' dev r bits f (transform_cap capa) capa) (?P'281 s' dev r bits f (transform_cap capa) capa) (select {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)} >>= mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od)) (mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])))
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>s. True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?P'122 s' dev r bits f cap capa s)\<rbrace>
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and (if is_device_untyped_cap capa then \<lambda>s. valid_idle s \<and> (fst cref \<noteq> idle_thread s \<and> valid_etcbs s) \<and> True else (\<lambda>a. valid_idle a \<and> fst cref \<noteq> idle_thread a \<and> valid_etcbs a \<and> True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> (?P'281 s' dev r bits f cap capa and (\<lambda>s. \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa))) s)\<rbrace>
 4. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 5. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 6. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 7. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (8 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa)\<rbrakk> \<Longrightarrow> map (\<lambda>i. free_range_of_untyped (i * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)) (?xs286 s' dev r bits f cap capa) \<in> {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)}
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P'122 s' dev r bits f (transform_cap capa) capa) (?P'281 s' dev r bits f (transform_cap capa) capa) (mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od) (map (\<lambda>i. free_range_of_untyped (i * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)) (?xs286 s' dev r bits f cap capa))) (mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])))
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>s. True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?P'122 s' dev r bits f cap capa s)\<rbrace>
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and (if is_device_untyped_cap capa then \<lambda>s. valid_idle s \<and> (fst cref \<noteq> idle_thread s \<and> valid_etcbs s) \<and> True else (\<lambda>a. valid_idle a \<and> fst cref \<noteq> idle_thread a \<and> valid_etcbs a \<and> True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> (?P'281 s' dev r bits f cap capa and (\<lambda>s. \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa))) s)\<rbrace>
 5. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 6. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 7. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 8. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (8 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P'122 s' dev r bits f (transform_cap capa) capa) (?P'281 s' dev r bits f (transform_cap capa) capa) (mapME_x (\<lambda>r. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) r);
returnOk () \<sqinter> throw
od) (map (\<lambda>i. free_range_of_untyped (i * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)) (?xs286 s' dev r bits f cap capa))) (mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])))
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa)\<rbrakk> \<Longrightarrow> map (\<lambda>i. free_range_of_untyped (i * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)) (?xs286 s' dev r bits f cap capa) \<in> {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)}
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>s. True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?P'122 s' dev r bits f cap capa s)\<rbrace>
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and (if is_device_untyped_cap capa then \<lambda>s. valid_idle s \<and> (fst cref \<noteq> idle_thread s \<and> valid_etcbs s) \<and> True else (\<lambda>a. valid_idle a \<and> fst cref \<noteq> idle_thread a \<and> valid_etcbs a \<and> True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> (?P'281 s' dev r bits f cap capa and (\<lambda>s. \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa))) s)\<rbrace>
 5. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 6. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 7. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 8. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (8 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?P'122 s' dev r bits f (transform_cap capa) capa) (?P'281 s' dev r bits f (transform_cap capa) capa) (mapME_x (\<lambda>x. do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)));
returnOk () \<sqinter> throw
od) (?xs286 s' dev r bits f (transform_cap capa) capa)) (mapME_x (\<lambda>i. do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat i << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (i * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])))
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa)\<rbrakk> \<Longrightarrow> map (\<lambda>i. free_range_of_untyped (i * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)) (?xs286 s' dev r bits f cap capa) \<in> {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)}
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>s. True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ?P'122 s' dev r bits f cap capa s)\<rbrace>
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and (if is_device_untyped_cap capa then \<lambda>s. valid_idle s \<and> (fst cref \<noteq> idle_thread s \<and> valid_etcbs s) \<and> True else (\<lambda>a. valid_idle a \<and> fst cref \<noteq> idle_thread a \<and> valid_etcbs a \<and> True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> (?P'281 s' dev r bits f cap capa and (\<lambda>s. \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa))) s)\<rbrace>
 5. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 6. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 7. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 8. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (10 subgoals):
 1. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) (do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)));
returnOk () \<sqinter> throw
od) (do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od)
 2. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace> do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)));
returnOk () \<sqinter> throw
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace>, -
 3. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace> do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace>, -
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa)\<rbrakk> \<Longrightarrow> map (\<lambda>i. free_range_of_untyped (i * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])) \<in> {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)}
 5. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>s. True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> (\<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True))\<rbrace>
 6. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and (if is_device_untyped_cap capa then \<lambda>s. valid_idle s \<and> (fst cref \<noteq> idle_thread s \<and> valid_etcbs s) \<and> True else (\<lambda>a. valid_idle a \<and> fst cref \<noteq> idle_thread a \<and> valid_etcbs a \<and> True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ((\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) a) and (\<lambda>s. \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa))) s)\<rbrace>
 7. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 8. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 9. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 10. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (12 subgoals):
 1. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?Q569 s' dev r bits f cap capa x) (?Q'569 s' dev r bits f cap capa x) (do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)));
returnOk () \<sqinter> throw
od) (do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od)
 2. \<And>s' dev r bits f cap capa x s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])); True\<rbrakk> \<Longrightarrow> ?Q569 s' dev r bits f cap capa x s
 3. \<And>s' dev r bits f cap capa x s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])); (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrakk> \<Longrightarrow> ?Q'569 s' dev r bits f cap capa x s
 4. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace> do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)));
returnOk () \<sqinter> throw
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace>, -
 5. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace> do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace>, -
 6. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa)\<rbrakk> \<Longrightarrow> map (\<lambda>i. free_range_of_untyped (i * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])) \<in> {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)}
 7. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>s. True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> (\<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True))\<rbrace>
 8. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and (if is_device_untyped_cap capa then \<lambda>s. valid_idle s \<and> (fst cref \<noteq> idle_thread s \<and> valid_etcbs s) \<and> True else (\<lambda>a. valid_idle a \<and> fst cref \<noteq> idle_thread a \<and> valid_etcbs a \<and> True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ((\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) a) and (\<lambda>s. \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa))) s)\<rbrace>
 9. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 10. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?Q569 s' dev r bits f cap capa x) (?Q'569 s' dev r bits f cap capa x) (do _ <- return ();
y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)));
returnOk () \<sqinter> throw
od) (do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od)
 2. \<And>s' dev r bits f cap capa x s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])); True\<rbrakk> \<Longrightarrow> ?Q569 s' dev r bits f cap capa x s
 3. \<And>s' dev r bits f cap capa x s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])); (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrakk> \<Longrightarrow> ?Q'569 s' dev r bits f cap capa x s
 4. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace> do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)));
returnOk () \<sqinter> throw
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace>, -
 5. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace> do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace>, -
 6. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa)\<rbrakk> \<Longrightarrow> map (\<lambda>i. free_range_of_untyped (i * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])) \<in> {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)}
 7. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>s. True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> (\<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True))\<rbrace>
 8. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and (if is_device_untyped_cap capa then \<lambda>s. valid_idle s \<and> (fst cref \<noteq> idle_thread s \<and> valid_etcbs s) \<and> True else (\<lambda>a. valid_idle a \<and> fst cref \<noteq> idle_thread a \<and> valid_etcbs a \<and> True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ((\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) a) and (\<lambda>s. \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa))) s)\<rbrace>
 9. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 10. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> dcorres dc (?P575 s' dev r bits f cap capa x) (?P'575 s' dev r bits f cap capa x) (return ()) (do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits)))
 2. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R575 s' dev r bits f cap capa x) (?R'575 s' dev r bits f cap capa x) (do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)));
returnOk () \<sqinter> throw
od) (do y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od)
 3. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q575 s' dev r bits f cap capa x\<rbrace> return () \<lbrace>\<lambda>xa. ?R575 s' dev r bits f cap capa x\<rbrace>
 4. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'575 s' dev r bits f cap capa x\<rbrace> do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits)) \<lbrace>\<lambda>xa. ?R'575 s' dev r bits f cap capa x\<rbrace>
 5. \<And>s' dev r bits f cap capa x s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])); True\<rbrakk> \<Longrightarrow> (?P575 s' dev r bits f cap capa x and ?Q575 s' dev r bits f cap capa x) s
 6. \<And>s' dev r bits f cap capa x s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])); (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrakk> \<Longrightarrow> (?P'575 s' dev r bits f cap capa x and ?Q'575 s' dev r bits f cap capa x) s
 7. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace> do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)));
returnOk () \<sqinter> throw
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace>, -
 8. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace> do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace>, -
 9. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa)\<rbrakk> \<Longrightarrow> map (\<lambda>i. free_range_of_untyped (i * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])) \<in> {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)}
 10. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>s. True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> (\<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True))\<rbrace>
A total of 15 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> is_aligned (obj_ref_of capa + (word_of_nat x << resetChunkBits)) resetChunkBits
 2. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> 2 \<le> resetChunkBits
 3. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> resetChunkBits < word_bits
 4. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R575 s' dev r bits f cap capa x) (?R'575 s' dev r bits f cap capa x) (do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)));
returnOk () \<sqinter> throw
od) (do y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od)
 5. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q575 s' dev r bits f cap capa x\<rbrace> return () \<lbrace>\<lambda>xa. ?R575 s' dev r bits f cap capa x\<rbrace>
 6. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'575 s' dev r bits f cap capa x\<rbrace> do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits)) \<lbrace>\<lambda>xa. ?R'575 s' dev r bits f cap capa x\<rbrace>
 7. \<And>s' dev r bits f cap capa x s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q575 s' dev r bits f cap capa x) s
 8. \<And>s' dev r bits f cap capa x s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])); (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrakk> \<Longrightarrow> (pspace_no_overlap {obj_ref_of capa + (word_of_nat x << resetChunkBits)..obj_ref_of capa + (word_of_nat x << resetChunkBits) + 2 ^ resetChunkBits - 1} and valid_objs and valid_etcbs and ?Q'575 s' dev r bits f cap capa x) s
 9. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace> do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)));
returnOk () \<sqinter> throw
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace>, -
 10. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace> do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace>, -
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> 2 \<le> resetChunkBits
 2. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> resetChunkBits < word_bits
 3. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R575 s' dev r bits f cap capa x) (?R'575 s' dev r bits f cap capa x) (do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)));
returnOk () \<sqinter> throw
od) (do y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od)
 4. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q575 s' dev r bits f cap capa x\<rbrace> return () \<lbrace>\<lambda>xa. ?R575 s' dev r bits f cap capa x\<rbrace>
 5. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'575 s' dev r bits f cap capa x\<rbrace> do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits)) \<lbrace>\<lambda>xa. ?R'575 s' dev r bits f cap capa x\<rbrace>
 6. \<And>s' dev r bits f cap capa x s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q575 s' dev r bits f cap capa x) s
 7. \<And>s' dev r bits f cap capa x s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])); (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrakk> \<Longrightarrow> (pspace_no_overlap {obj_ref_of capa + (word_of_nat x << resetChunkBits)..obj_ref_of capa + (word_of_nat x << resetChunkBits) + 2 ^ resetChunkBits - 1} and valid_objs and valid_etcbs and ?Q'575 s' dev r bits f cap capa x) s
 8. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace> do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)));
returnOk () \<sqinter> throw
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace>, -
 9. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace> do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace>, -
 10. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa)\<rbrakk> \<Longrightarrow> map (\<lambda>i. free_range_of_untyped (i * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])) \<in> {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)}
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> resetChunkBits < word_bits
 2. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R575 s' dev r bits f cap capa x) (?R'575 s' dev r bits f cap capa x) (do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)));
returnOk () \<sqinter> throw
od) (do y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od)
 3. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q575 s' dev r bits f cap capa x\<rbrace> return () \<lbrace>\<lambda>xa. ?R575 s' dev r bits f cap capa x\<rbrace>
 4. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'575 s' dev r bits f cap capa x\<rbrace> do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits)) \<lbrace>\<lambda>xa. ?R'575 s' dev r bits f cap capa x\<rbrace>
 5. \<And>s' dev r bits f cap capa x s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q575 s' dev r bits f cap capa x) s
 6. \<And>s' dev r bits f cap capa x s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])); (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrakk> \<Longrightarrow> (pspace_no_overlap {obj_ref_of capa + (word_of_nat x << resetChunkBits)..obj_ref_of capa + (word_of_nat x << resetChunkBits) + 2 ^ resetChunkBits - 1} and valid_objs and valid_etcbs and ?Q'575 s' dev r bits f cap capa x) s
 7. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace> do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)));
returnOk () \<sqinter> throw
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace>, -
 8. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace> do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace>, -
 9. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa)\<rbrakk> \<Longrightarrow> map (\<lambda>i. free_range_of_untyped (i * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])) \<in> {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)}
 10. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>s. True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> (\<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True))\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R575 s' dev r bits f cap capa x) (?R'575 s' dev r bits f cap capa x) (do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)));
returnOk () \<sqinter> throw
od) (do y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od)
 2. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q575 s' dev r bits f cap capa x\<rbrace> return () \<lbrace>\<lambda>xa. ?R575 s' dev r bits f cap capa x\<rbrace>
 3. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'575 s' dev r bits f cap capa x\<rbrace> do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits)) \<lbrace>\<lambda>xa. ?R'575 s' dev r bits f cap capa x\<rbrace>
 4. \<And>s' dev r bits f cap capa x s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q575 s' dev r bits f cap capa x) s
 5. \<And>s' dev r bits f cap capa x s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])); (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrakk> \<Longrightarrow> (pspace_no_overlap {obj_ref_of capa + (word_of_nat x << resetChunkBits)..obj_ref_of capa + (word_of_nat x << resetChunkBits) + 2 ^ resetChunkBits - 1} and valid_objs and valid_etcbs and ?Q'575 s' dev r bits f cap capa x) s
 6. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace> do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)));
returnOk () \<sqinter> throw
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace>, -
 7. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace> do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace>, -
 8. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa)\<rbrakk> \<Longrightarrow> map (\<lambda>i. free_range_of_untyped (i * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])) \<in> {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)}
 9. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>s. True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> (\<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True))\<rbrace>
 10. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and (if is_device_untyped_cap capa then \<lambda>s. valid_idle s \<and> (fst cref \<noteq> idle_thread s \<and> valid_etcbs s) \<and> True else (\<lambda>a. valid_idle a \<and> fst cref \<noteq> idle_thread a \<and> valid_etcbs a \<and> True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ((\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) a) and (\<lambda>s. \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa))) s)\<rbrace>
A total of 14 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> dcorres (?r'600 s' dev r bits f cap capa x) (?P600 s' dev r bits f cap capa x) (?P'600 s' dev r bits f cap capa x) (KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)))) (CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref)
 2. \<And>s' dev r bits f cap capa x rv rv'. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])); ?r'600 s' dev r bits f cap capa x rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R600 s' dev r bits f cap capa x rv) (?R'600 s' dev r bits f cap capa x rv') (returnOk () \<sqinter> throw) Exceptions_A.preemption_point
 3. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q600 s' dev r bits f cap capa x\<rbrace> KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa))) \<lbrace>?R600 s' dev r bits f cap capa x\<rbrace>
 4. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'600 s' dev r bits f cap capa x\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref \<lbrace>?R'600 s' dev r bits f cap capa x\<rbrace>
 5. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q575 s' dev r bits f cap capa x\<rbrace> return () \<lbrace>\<lambda>xa. ?P600 s' dev r bits f cap capa x and ?Q600 s' dev r bits f cap capa x\<rbrace>
 6. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'575 s' dev r bits f cap capa x\<rbrace> do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits)) \<lbrace>\<lambda>xa. ?P'600 s' dev r bits f cap capa x and ?Q'600 s' dev r bits f cap capa x\<rbrace>
 7. \<And>s' dev r bits f cap capa x s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q575 s' dev r bits f cap capa x) s
 8. \<And>s' dev r bits f cap capa x s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])); (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrakk> \<Longrightarrow> (pspace_no_overlap {obj_ref_of capa + (word_of_nat x << resetChunkBits)..obj_ref_of capa + (word_of_nat x << resetChunkBits) + 2 ^ resetChunkBits - 1} and valid_objs and valid_etcbs and ?Q'575 s' dev r bits f cap capa x) s
 9. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace> do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)));
returnOk () \<sqinter> throw
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace>, -
 10. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace> do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace>, -
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x < 2 ^ (bits_of capa - resetChunkBits) \<and> x * 2 ^ resetChunkBits < free_index_of capa\<rbrakk> \<Longrightarrow> set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)) = cdl_cap.UntypedCap False {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa))
 2. \<And>s' dev r bits f cap capa x rv rv'. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])); dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R600 s' dev r bits f cap capa x rv) (?R'600 s' dev r bits f cap capa x rv') (returnOk () \<sqinter> throw) Exceptions_A.preemption_point
 3. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q600 s' dev r bits f cap capa x\<rbrace> KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa))) \<lbrace>?R600 s' dev r bits f cap capa x\<rbrace>
 4. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'600 s' dev r bits f cap capa x\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref \<lbrace>?R'600 s' dev r bits f cap capa x\<rbrace>
 5. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q575 s' dev r bits f cap capa x\<rbrace> return () \<lbrace>\<lambda>xa. (\<lambda>_. True) and ?Q600 s' dev r bits f cap capa x\<rbrace>
 6. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'575 s' dev r bits f cap capa x\<rbrace> do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits)) \<lbrace>\<lambda>xa. (\<lambda>s. valid_idle s \<and> fst cref \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'600 s' dev r bits f cap capa x\<rbrace>
 7. \<And>s' dev r bits f cap capa x s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q575 s' dev r bits f cap capa x) s
 8. \<And>s' dev r bits f cap capa x s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])); (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrakk> \<Longrightarrow> (pspace_no_overlap {obj_ref_of capa + (word_of_nat x << resetChunkBits)..obj_ref_of capa + (word_of_nat x << resetChunkBits) + 2 ^ resetChunkBits - 1} and valid_objs and valid_etcbs and ?Q'575 s' dev r bits f cap capa x) s
 9. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace> do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)));
returnOk () \<sqinter> throw
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace>, -
 10. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace> do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace>, -
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s' dev r bits f cap capa x rv rv'. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])); dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R600 s' dev r bits f cap capa x rv) (?R'600 s' dev r bits f cap capa x rv') (returnOk () \<sqinter> throw) Exceptions_A.preemption_point
 2. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q600 s' dev r bits f cap capa x\<rbrace> KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa))) \<lbrace>?R600 s' dev r bits f cap capa x\<rbrace>
 3. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'600 s' dev r bits f cap capa x\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref \<lbrace>?R'600 s' dev r bits f cap capa x\<rbrace>
 4. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q575 s' dev r bits f cap capa x\<rbrace> return () \<lbrace>\<lambda>xa. (\<lambda>_. True) and ?Q600 s' dev r bits f cap capa x\<rbrace>
 5. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'575 s' dev r bits f cap capa x\<rbrace> do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits)) \<lbrace>\<lambda>xa. (\<lambda>s. valid_idle s \<and> fst cref \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'600 s' dev r bits f cap capa x\<rbrace>
 6. \<And>s' dev r bits f cap capa x s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q575 s' dev r bits f cap capa x) s
 7. \<And>s' dev r bits f cap capa x s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])); (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrakk> \<Longrightarrow> (pspace_no_overlap {obj_ref_of capa + (word_of_nat x << resetChunkBits)..obj_ref_of capa + (word_of_nat x << resetChunkBits) + 2 ^ resetChunkBits - 1} and valid_objs and valid_etcbs and ?Q'575 s' dev r bits f cap capa x) s
 8. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace> do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)));
returnOk () \<sqinter> throw
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace>, -
 9. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace> do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace>, -
 10. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa)\<rbrakk> \<Longrightarrow> map (\<lambda>i. free_range_of_untyped (i * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])) \<in> {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)}
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s' dev r bits f cap capa x rv rv'. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])); dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R629 s' dev r bits f cap capa x rv rv' (?s'629 s' dev r bits f cap capa x rv rv') (?dev629 s' dev r bits f cap capa x rv rv') (?r629 s' dev r bits f cap capa x rv rv') (?bits629 s' dev r bits f cap capa x rv rv') (?f629 s' dev r bits f cap capa x rv rv') (?cap629 s' dev r bits f cap capa x rv rv') (?capa629 s' dev r bits f cap capa x rv rv') (?x629 s' dev r bits f cap capa x rv rv') (?rv629 s' dev r bits f cap capa x rv rv')) (?R'629 s' dev r bits f cap capa x rv rv' (?s'629 s' dev r bits f cap capa x rv rv') (?dev629 s' dev r bits f cap capa x rv rv') (?r629 s' dev r bits f cap capa x rv rv') (?bits629 s' dev r bits f cap capa x rv rv') (?f629 s' dev r bits f cap capa x rv rv') (?cap629 s' dev r bits f cap capa x rv rv') (?capa629 s' dev r bits f cap capa x rv rv') (?x629 s' dev r bits f cap capa x rv rv') (?rv'629 s' dev r bits f cap capa x rv rv')) (throw \<sqinter> returnOk ()) Exceptions_A.preemption_point
 2. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q600 s' dev r bits f cap capa x\<rbrace> KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa))) \<lbrace>?R600 s' dev r bits f cap capa x\<rbrace>
 3. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'600 s' dev r bits f cap capa x\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref \<lbrace>?R'600 s' dev r bits f cap capa x\<rbrace>
 4. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q575 s' dev r bits f cap capa x\<rbrace> return () \<lbrace>\<lambda>xa. (\<lambda>_. True) and ?Q600 s' dev r bits f cap capa x\<rbrace>
 5. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'575 s' dev r bits f cap capa x\<rbrace> do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits)) \<lbrace>\<lambda>xa. (\<lambda>s. valid_idle s \<and> fst cref \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'600 s' dev r bits f cap capa x\<rbrace>
 6. \<And>s' dev r bits f cap capa x s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q575 s' dev r bits f cap capa x) s
 7. \<And>s' dev r bits f cap capa x s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])); (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrakk> \<Longrightarrow> (pspace_no_overlap {obj_ref_of capa + (word_of_nat x << resetChunkBits)..obj_ref_of capa + (word_of_nat x << resetChunkBits) + 2 ^ resetChunkBits - 1} and valid_objs and valid_etcbs and ?Q'575 s' dev r bits f cap capa x) s
 8. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace> do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)));
returnOk () \<sqinter> throw
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace>, -
 9. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace> do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace>, -
 10. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa)\<rbrakk> \<Longrightarrow> map (\<lambda>i. free_range_of_untyped (i * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])) \<in> {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)}
A total of 16 subgoals...
flex-flex pairs:
\<lambda>s' dev r bits f cap capa x rv rv'. ?R'629 s' dev r bits f cap capa x rv rv' (?s'629 s' dev r bits f cap capa x rv rv') (?dev629 s' dev r bits f cap capa x rv rv') (?r629 s' dev r bits f cap capa x rv rv') (?bits629 s' dev r bits f cap capa x rv rv') (?f629 s' dev r bits f cap capa x rv rv') (?cap629 s' dev r bits f cap capa x rv rv') (?capa629 s' dev r bits f cap capa x rv rv') (?x629 s' dev r bits f cap capa x rv rv') (?rv'629 s' dev r bits f cap capa x rv rv') \<equiv>\<^sup>? \<lambda>s' dev r bits f cap capa x rv. ?R'600 s' dev r bits f cap capa x
\<lambda>s' dev r bits f cap capa x rv rv'. ?R629 s' dev r bits f cap capa x rv rv' (?s'629 s' dev r bits f cap capa x rv rv') (?dev629 s' dev r bits f cap capa x rv rv') (?r629 s' dev r bits f cap capa x rv rv') (?bits629 s' dev r bits f cap capa x rv rv') (?f629 s' dev r bits f cap capa x rv rv') (?cap629 s' dev r bits f cap capa x rv rv') (?capa629 s' dev r bits f cap capa x rv rv') (?x629 s' dev r bits f cap capa x rv rv') (?rv629 s' dev r bits f cap capa x rv rv') \<equiv>\<^sup>? \<lambda>s' dev r bits f cap capa x rv rv'. ?R600 s' dev r bits f cap capa x rv proof (prove)
goal (15 subgoals):
 1. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q600 s' dev r bits f cap capa x\<rbrace> KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa))) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'600 s' dev r bits f cap capa x\<rbrace> CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q575 s' dev r bits f cap capa x\<rbrace> return () \<lbrace>\<lambda>xa. (\<lambda>_. True) and ?Q600 s' dev r bits f cap capa x\<rbrace>
 4. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'575 s' dev r bits f cap capa x\<rbrace> do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits)) \<lbrace>\<lambda>xa. (\<lambda>s. valid_idle s \<and> fst cref \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'600 s' dev r bits f cap capa x\<rbrace>
 5. \<And>s' dev r bits f cap capa x s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q575 s' dev r bits f cap capa x) s
 6. \<And>s' dev r bits f cap capa x s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])); (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrakk> \<Longrightarrow> (pspace_no_overlap {obj_ref_of capa + (word_of_nat x << resetChunkBits)..obj_ref_of capa + (word_of_nat x << resetChunkBits) + 2 ^ resetChunkBits - 1} and valid_objs and valid_etcbs and ?Q'575 s' dev r bits f cap capa x) s
 7. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace> do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)));
returnOk () \<sqinter> throw
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace>, -
 8. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace> do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace>, -
 9. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa)\<rbrakk> \<Longrightarrow> map (\<lambda>i. free_range_of_untyped (i * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])) \<in> {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)}
 10. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>s. True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> (\<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True))\<rbrace>
A total of 15 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s' dev r bits f cap capa x s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ((\<lambda>_. True) and (\<lambda>s. True))) s
 2. \<And>s' dev r bits f cap capa x s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])); (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrakk> \<Longrightarrow> (pspace_no_overlap {obj_ref_of capa + (word_of_nat x << resetChunkBits)..obj_ref_of capa + (word_of_nat x << resetChunkBits) + 2 ^ resetChunkBits - 1} and valid_objs and valid_etcbs and (\<lambda>s. valid_idle s \<and> fst cref \<noteq> idle_thread s \<and> valid_etcbs s \<and> True)) s
 3. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace> do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)));
returnOk () \<sqinter> throw
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace>, -
 4. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace> do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace>, -
 5. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa)\<rbrakk> \<Longrightarrow> map (\<lambda>i. free_range_of_untyped (i * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])) \<in> {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)}
 6. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>s. True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> (\<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True))\<rbrace>
 7. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and (if is_device_untyped_cap capa then \<lambda>s. valid_idle s \<and> (fst cref \<noteq> idle_thread s \<and> valid_etcbs s) \<and> True else (\<lambda>a. valid_idle a \<and> fst cref \<noteq> idle_thread a \<and> valid_etcbs a \<and> True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ((\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) a) and (\<lambda>s. \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa))) s)\<rbrace>
 8. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 9. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 10. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s' dev r bits f cap capa x s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x < 2 ^ (bits_of capa - resetChunkBits) \<and> x * 2 ^ resetChunkBits < free_index_of capa; valid_objs s \<and> valid_etcbs s \<and> pspace_no_overlap (untyped_range capa) s \<and> valid_idle s \<and> idle_thread s \<noteq> fst cref \<and> cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref s\<rbrakk> \<Longrightarrow> pspace_no_overlap {obj_ref_of capa + (word_of_nat x << resetChunkBits)..obj_ref_of capa + (word_of_nat x << resetChunkBits) + 2 ^ resetChunkBits - 1} s \<and> fst cref \<noteq> idle_thread s
 2. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace> do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)));
returnOk () \<sqinter> throw
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace>, -
 3. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace> do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace>, -
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa)\<rbrakk> \<Longrightarrow> map (\<lambda>i. free_range_of_untyped (i * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])) \<in> {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)}
 5. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>s. True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> (\<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True))\<rbrace>
 6. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and (if is_device_untyped_cap capa then \<lambda>s. valid_idle s \<and> (fst cref \<noteq> idle_thread s \<and> valid_etcbs s) \<and> True else (\<lambda>a. valid_idle a \<and> fst cref \<noteq> idle_thread a \<and> valid_etcbs a \<and> True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ((\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) a) and (\<lambda>s. \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa))) s)\<rbrace>
 7. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 8. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 9. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 10. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (10 subgoals):
 1. \<And>s' dev r bits f x s xa deva ra bitsa fa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); xa \<turnstile> cap.UntypedCap False ra bitsa fa; \<not> deva; \<not> bitsa < resetChunkBits; x < 2 ^ (bitsa - resetChunkBits); x * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap False ra bitsa fa); valid_objs s; is_aligned ra bitsa; valid_etcbs s; bitsa < word_bits; pspace_no_overlap {ra..ra + 2 ^ bitsa - 1} s; 2 < bitsa; free_index_of (cap.UntypedCap False ra bitsa fa) \<le> 2 ^ bitsa; valid_idle s; idle_thread s \<noteq> fst cref; cte_wp_at (\<lambda>cp. \<exists>idx. cp = cap.UntypedCap False ra bitsa idx) cref s\<rbrakk> \<Longrightarrow> pspace_no_overlap {ra + (word_of_nat x << resetChunkBits)..ra + (word_of_nat x << resetChunkBits) + 2 ^ resetChunkBits - 1} s
 2. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace> do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)));
returnOk () \<sqinter> throw
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace>, -
 3. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace> do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace>, -
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa)\<rbrakk> \<Longrightarrow> map (\<lambda>i. free_range_of_untyped (i * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])) \<in> {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)}
 5. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>s. True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> (\<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True))\<rbrace>
 6. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and (if is_device_untyped_cap capa then \<lambda>s. valid_idle s \<and> (fst cref \<noteq> idle_thread s \<and> valid_etcbs s) \<and> True else (\<lambda>a. valid_idle a \<and> fst cref \<noteq> idle_thread a \<and> valid_etcbs a \<and> True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ((\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) a) and (\<lambda>s. \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa))) s)\<rbrace>
 7. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 8. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 9. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 10. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (10 subgoals):
 1. \<And>s' dev r bits f x s xa deva ra bitsa fa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); xa \<turnstile> cap.UntypedCap False ra bitsa fa; \<not> deva; \<not> bitsa < resetChunkBits; x < 2 ^ (bitsa - resetChunkBits); x * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap False ra bitsa fa); valid_objs s; is_aligned ra bitsa; valid_etcbs s; bitsa < word_bits; 2 < bitsa; free_index_of (cap.UntypedCap False ra bitsa fa) \<le> 2 ^ bitsa; valid_idle s; idle_thread s \<noteq> fst cref; cte_wp_at (\<lambda>cp. \<exists>idx. cp = cap.UntypedCap False ra bitsa idx) cref s\<rbrakk> \<Longrightarrow> {ra + (word_of_nat x << resetChunkBits)..ra + (word_of_nat x << resetChunkBits) + 2 ^ resetChunkBits - 1} \<subseteq> {ra..ra + 2 ^ bitsa - 1}
 2. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace> do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)));
returnOk () \<sqinter> throw
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace>, -
 3. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace> do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace>, -
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa)\<rbrakk> \<Longrightarrow> map (\<lambda>i. free_range_of_untyped (i * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])) \<in> {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)}
 5. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>s. True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> (\<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True))\<rbrace>
 6. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and (if is_device_untyped_cap capa then \<lambda>s. valid_idle s \<and> (fst cref \<noteq> idle_thread s \<and> valid_etcbs s) \<and> True else (\<lambda>a. valid_idle a \<and> fst cref \<noteq> idle_thread a \<and> valid_etcbs a \<and> True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ((\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) a) and (\<lambda>s. \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa))) s)\<rbrace>
 7. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 8. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 9. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 10. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (10 subgoals):
 1. \<And>s' dev r bits f x s xa deva ra bitsa fa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); xa \<turnstile> cap.UntypedCap False ra bitsa fa; \<not> deva; \<not> bitsa < resetChunkBits; x < 2 ^ (bitsa - resetChunkBits); x * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap False ra bitsa fa); valid_objs s; is_aligned ra bitsa; valid_etcbs s; bitsa < word_bits; 2 < bitsa; free_index_of (cap.UntypedCap False ra bitsa fa) \<le> 2 ^ bitsa; valid_idle s; idle_thread s \<noteq> fst cref; cte_wp_at (\<lambda>cp. \<exists>idx. cp = cap.UntypedCap False ra bitsa idx) cref s\<rbrakk> \<Longrightarrow> word_of_nat x << resetChunkBits < 2 ^ bitsa
 2. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace> do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)));
returnOk () \<sqinter> throw
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace>, -
 3. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace> do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace>, -
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa)\<rbrakk> \<Longrightarrow> map (\<lambda>i. free_range_of_untyped (i * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])) \<in> {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)}
 5. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>s. True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> (\<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True))\<rbrace>
 6. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and (if is_device_untyped_cap capa then \<lambda>s. valid_idle s \<and> (fst cref \<noteq> idle_thread s \<and> valid_etcbs s) \<and> True else (\<lambda>a. valid_idle a \<and> fst cref \<noteq> idle_thread a \<and> valid_etcbs a \<and> True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ((\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) a) and (\<lambda>s. \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa))) s)\<rbrace>
 7. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 8. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 9. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 10. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (11 subgoals):
 1. \<And>s' dev r bits f x s xa deva ra bitsa fa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); xa \<turnstile> cap.UntypedCap False ra bitsa fa; \<not> deva; \<not> bitsa < resetChunkBits; x < 2 ^ (bitsa - resetChunkBits); x * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap False ra bitsa fa); valid_objs s; is_aligned ra bitsa; valid_etcbs s; bitsa < word_bits; 2 < bitsa; free_index_of (cap.UntypedCap False ra bitsa fa) \<le> 2 ^ bitsa; valid_idle s; idle_thread s \<noteq> fst cref; cte_wp_at (\<lambda>cp. \<exists>idx. cp = cap.UntypedCap False ra bitsa idx) cref s\<rbrakk> \<Longrightarrow> x < unat (2 ^ (bitsa - resetChunkBits))
 2. \<And>s' dev r bits f x s xa deva ra bitsa fa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); xa \<turnstile> cap.UntypedCap False ra bitsa fa; \<not> deva; \<not> bitsa < resetChunkBits; x < 2 ^ (bitsa - resetChunkBits); x * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap False ra bitsa fa); valid_objs s; is_aligned ra bitsa; valid_etcbs s; bitsa < word_bits; 2 < bitsa; free_index_of (cap.UntypedCap False ra bitsa fa) \<le> 2 ^ bitsa; valid_idle s; idle_thread s \<noteq> fst cref; cte_wp_at (\<lambda>cp. \<exists>idx. cp = cap.UntypedCap False ra bitsa idx) cref s\<rbrakk> \<Longrightarrow> bitsa < LENGTH(32)
 3. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace> do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)));
returnOk () \<sqinter> throw
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace>, -
 4. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace> do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace>, -
 5. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa)\<rbrakk> \<Longrightarrow> map (\<lambda>i. free_range_of_untyped (i * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])) \<in> {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)}
 6. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>s. True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> (\<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True))\<rbrace>
 7. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and (if is_device_untyped_cap capa then \<lambda>s. valid_idle s \<and> (fst cref \<noteq> idle_thread s \<and> valid_etcbs s) \<and> True else (\<lambda>a. valid_idle a \<and> fst cref \<noteq> idle_thread a \<and> valid_etcbs a \<and> True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ((\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) a) and (\<lambda>s. \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa))) s)\<rbrace>
 8. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 9. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 10. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s' dev r bits f x s xa deva ra bitsa fa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); xa \<turnstile> cap.UntypedCap False ra bitsa fa; \<not> deva; \<not> bitsa < resetChunkBits; x < 2 ^ (bitsa - resetChunkBits); x * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap False ra bitsa fa); valid_objs s; is_aligned ra bitsa; valid_etcbs s; bitsa < word_bits; 2 < bitsa; free_index_of (cap.UntypedCap False ra bitsa fa) \<le> 2 ^ bitsa; valid_idle s; idle_thread s \<noteq> fst cref; cte_wp_at (\<lambda>cp. \<exists>idx. cp = cap.UntypedCap False ra bitsa idx) cref s\<rbrakk> \<Longrightarrow> bitsa < LENGTH(32)
 2. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace> do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)));
returnOk () \<sqinter> throw
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace>, -
 3. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace> do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace>, -
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa)\<rbrakk> \<Longrightarrow> map (\<lambda>i. free_range_of_untyped (i * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])) \<in> {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)}
 5. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>s. True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> (\<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True))\<rbrace>
 6. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and (if is_device_untyped_cap capa then \<lambda>s. valid_idle s \<and> (fst cref \<noteq> idle_thread s \<and> valid_etcbs s) \<and> True else (\<lambda>a. valid_idle a \<and> fst cref \<noteq> idle_thread a \<and> valid_etcbs a \<and> True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ((\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) a) and (\<lambda>s. \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa))) s)\<rbrace>
 7. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 8. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 9. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 10. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (9 subgoals):
 1. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace> do y <- KHeap_D.set_cap (transform_cslot_ptr cref) (set_available_range (transform_cap capa) (free_range_of_untyped (x * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)));
returnOk () \<sqinter> throw
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True\<rbrace>, -
 2. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace> do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace>, -
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa)\<rbrakk> \<Longrightarrow> map (\<lambda>i. free_range_of_untyped (i * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])) \<in> {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)}
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>s. True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> (\<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True))\<rbrace>
 5. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and (if is_device_untyped_cap capa then \<lambda>s. valid_idle s \<and> (fst cref \<noteq> idle_thread s \<and> valid_etcbs s) \<and> True else (\<lambda>a. valid_idle a \<and> fst cref \<noteq> idle_thread a \<and> valid_etcbs a \<and> True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ((\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) a) and (\<lambda>s. \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa))) s)\<rbrace>
 6. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 7. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 8. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 9. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (8 subgoals):
 1. \<And>s' dev r bits f cap capa x. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x \<in> set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)]))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace> do y <- do_machine_op (clearMemory (obj_ref_of capa + (word_of_nat x << resetChunkBits)) (2 ^ resetChunkBits));
y <- CSpaceAcc_A.set_cap (cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits)) cref;
Exceptions_A.preemption_point
od \<lbrace>\<lambda>_ s. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) s\<rbrace>, -
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa)\<rbrakk> \<Longrightarrow> map (\<lambda>i. free_range_of_untyped (i * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])) \<in> {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)}
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>s. True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> (\<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True))\<rbrace>
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and (if is_device_untyped_cap capa then \<lambda>s. valid_idle s \<and> (fst cref \<noteq> idle_thread s \<and> valid_etcbs s) \<and> True else (\<lambda>a. valid_idle a \<and> fst cref \<noteq> idle_thread a \<and> valid_etcbs a \<and> True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ((\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) a) and (\<lambda>s. \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa))) s)\<rbrace>
 5. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 6. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 7. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 8. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (8 subgoals):
 1. \<And>s' dev r bits f cap capa x s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; Ex (valid_cap capa); x < 2 ^ (bits_of capa - resetChunkBits) \<and> x * 2 ^ resetChunkBits < free_index_of capa; (\<exists>y<2 ^ (bits_of capa - resetChunkBits). y * 2 ^ resetChunkBits < free_index_of capa) \<longrightarrow> valid_objs s \<and> valid_etcbs s \<and> pspace_no_overlap (untyped_range capa) s \<and> valid_idle s \<and> idle_thread s \<noteq> fst cref \<and> cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref s\<rbrakk> \<Longrightarrow> (\<exists>y<2 ^ (bits_of capa - resetChunkBits). y * 2 ^ resetChunkBits < free_index_of capa) \<longrightarrow> s \<turnstile> cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits) \<and> cte_wp_at Structures_A.is_untyped_cap cref s \<and> (\<exists>idx. cap.UntypedCap False (obj_ref_of capa) (bits_of capa) (x * 2 ^ resetChunkBits) = free_index_update (\<lambda>_. idx) capa) \<and> cte_wp_at (\<lambda>a. True) cref s
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa)\<rbrakk> \<Longrightarrow> map (\<lambda>i. free_range_of_untyped (i * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])) \<in> {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)}
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>s. True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> (\<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True))\<rbrace>
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and (if is_device_untyped_cap capa then \<lambda>s. valid_idle s \<and> (fst cref \<noteq> idle_thread s \<and> valid_etcbs s) \<and> True else (\<lambda>a. valid_idle a \<and> fst cref \<noteq> idle_thread a \<and> valid_etcbs a \<and> True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ((\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) a) and (\<lambda>s. \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa))) s)\<rbrace>
 5. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 6. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 7. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 8. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (8 subgoals):
 1. \<And>s' dev r bits f x s xa deva ra bitsa fa idxa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); xa \<turnstile> cap.UntypedCap False ra bitsa fa; \<not> deva; \<not> bitsa < resetChunkBits; x < 2 ^ (bitsa - resetChunkBits); x * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap False ra bitsa fa); valid_objs s; cap_aligned (cap.UntypedCap False ra bitsa fa); valid_etcbs s; 2 < bitsa; free_index_of (cap.UntypedCap False ra bitsa fa) \<le> 2 ^ bitsa; pspace_no_overlap {ra..ra + 2 ^ bitsa - 1} s; valid_idle s; idle_thread s \<noteq> fst cref; caps_of_state s cref = Some (cap.UntypedCap False ra bitsa idxa)\<rbrakk> \<Longrightarrow> s \<turnstile> cap.UntypedCap False ra bitsa (x * 2 ^ resetChunkBits)
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa)\<rbrakk> \<Longrightarrow> map (\<lambda>i. free_range_of_untyped (i * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])) \<in> {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)}
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>s. True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> (\<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True))\<rbrace>
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and (if is_device_untyped_cap capa then \<lambda>s. valid_idle s \<and> (fst cref \<noteq> idle_thread s \<and> valid_etcbs s) \<and> True else (\<lambda>a. valid_idle a \<and> fst cref \<noteq> idle_thread a \<and> valid_etcbs a \<and> True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ((\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) a) and (\<lambda>s. \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa))) s)\<rbrace>
 5. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 6. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 7. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 8. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (8 subgoals):
 1. \<And>s' dev r bits f x s xa deva ra bitsa fa idxa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); xa \<turnstile> cap.UntypedCap False ra bitsa fa; \<not> deva; \<not> bitsa < resetChunkBits; x < 2 ^ (bitsa - resetChunkBits); x * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap False ra bitsa fa); valid_objs s; cap_aligned (cap.UntypedCap False ra bitsa fa); valid_etcbs s; 2 < bitsa; free_index_of (cap.UntypedCap False ra bitsa fa) \<le> 2 ^ bitsa; pspace_no_overlap {ra..ra + 2 ^ bitsa - 1} s; valid_idle s; idle_thread s \<noteq> fst cref; caps_of_state s cref = Some (cap.UntypedCap False ra bitsa idxa); \<exists>cap. cap.UntypedCap False ra bitsa idxa = cap \<and> s \<turnstile> cap\<rbrakk> \<Longrightarrow> s \<turnstile> cap.UntypedCap False ra bitsa (x * 2 ^ resetChunkBits)
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa)\<rbrakk> \<Longrightarrow> map (\<lambda>i. free_range_of_untyped (i * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])) \<in> {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)}
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>s. True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> (\<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True))\<rbrace>
 4. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and (if is_device_untyped_cap capa then \<lambda>s. valid_idle s \<and> (fst cref \<noteq> idle_thread s \<and> valid_etcbs s) \<and> True else (\<lambda>a. valid_idle a \<and> fst cref \<noteq> idle_thread a \<and> valid_etcbs a \<and> True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ((\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) a) and (\<lambda>s. \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa))) s)\<rbrace>
 5. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 6. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 7. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 8. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (7 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa; \<not> is_device_untyped_cap capa \<and> \<not> bits_of capa < resetChunkBits; \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa)\<rbrakk> \<Longrightarrow> map (\<lambda>i. free_range_of_untyped (i * 2 ^ resetChunkBits) (bits_of capa) (obj_ref_of capa)) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])) \<in> {xs. (\<forall>S\<in>set xs. S \<subseteq> cap_objects (transform_cap capa) \<and> available_range (transform_cap capa) \<subset> S) \<and> xs \<noteq> [] \<and> last xs = cap_objects (transform_cap capa)}
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>s. True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> (\<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True))\<rbrace>
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and (if is_device_untyped_cap capa then \<lambda>s. valid_idle s \<and> (fst cref \<noteq> idle_thread s \<and> valid_etcbs s) \<and> True else (\<lambda>a. valid_idle a \<and> fst cref \<noteq> idle_thread a \<and> valid_etcbs a \<and> True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ((\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) a) and (\<lambda>s. \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa))) s)\<rbrace>
 4. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 5. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 6. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 7. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (7 subgoals):
 1. \<And>s' dev r bits f x deva ra bitsa fa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); 0 < free_index_of (cap.UntypedCap False ra bitsa fa); x \<turnstile> cap.UntypedCap False ra bitsa fa; \<not> deva; \<not> bitsa < resetChunkBits; cap_aligned (cap.UntypedCap False ra bitsa fa); 2 < bitsa; free_index_of (cap.UntypedCap False ra bitsa fa) \<le> 2 ^ bitsa\<rbrakk> \<Longrightarrow> (\<forall>S. S < 2 ^ (bitsa - resetChunkBits) \<and> S * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap False ra bitsa fa) \<longrightarrow> free_range_of_untyped (S * 2 ^ resetChunkBits) bitsa ra \<subseteq> {ra..ra + 2 ^ bitsa - 1} \<and> free_range_of_untyped fa bitsa ra \<subset> free_range_of_untyped (S * 2 ^ resetChunkBits) bitsa ra) \<and> filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap False ra bitsa fa)) [0..<2 ^ (bitsa - resetChunkBits)] \<noteq> [] \<and> last (map (\<lambda>i. free_range_of_untyped (i * 2 ^ resetChunkBits) bitsa ra) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap False ra bitsa fa)) [0..<2 ^ (bitsa - resetChunkBits)]))) = {ra..ra + 2 ^ bitsa - 1}
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>s. True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> (\<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True))\<rbrace>
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and (if is_device_untyped_cap capa then \<lambda>s. valid_idle s \<and> (fst cref \<noteq> idle_thread s \<and> valid_etcbs s) \<and> True else (\<lambda>a. valid_idle a \<and> fst cref \<noteq> idle_thread a \<and> valid_etcbs a \<and> True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ((\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) a) and (\<lambda>s. \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa))) s)\<rbrace>
 4. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 5. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 6. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 7. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (7 subgoals):
 1. \<And>s' dev r bits f x deva ra bitsa fa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); 0 < free_index_of (cap.UntypedCap False ra bitsa fa); x \<turnstile> cap.UntypedCap False ra bitsa fa; \<not> deva; \<not> bitsa < resetChunkBits; cap_aligned (cap.UntypedCap False ra bitsa fa); 2 < bitsa; free_index_of (cap.UntypedCap False ra bitsa fa) \<le> 2 ^ bitsa\<rbrakk> \<Longrightarrow> (\<forall>x. x < 2 ^ (bitsa - resetChunkBits) \<and> x * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap False ra bitsa fa) \<longrightarrow> (0 \<le> x * 2 ^ resetChunkBits \<and> is_aligned ra bitsa \<and> bitsa < size ra \<and> free_range_of_untyped 0 bitsa ra \<subseteq> {ra..ra + 2 ^ bitsa - 1}) \<and> is_aligned ra bitsa \<and> bitsa < size ra \<and> x * 2 ^ resetChunkBits < fa \<and> x * 2 ^ resetChunkBits < 2 ^ bitsa) \<and> filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap False ra bitsa fa)) [0..<2 ^ (bitsa - resetChunkBits)] \<noteq> [] \<and> last (map (\<lambda>i. free_range_of_untyped (i * 2 ^ resetChunkBits) bitsa ra) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap False ra bitsa fa)) [0..<2 ^ (bitsa - resetChunkBits)]))) = {ra..ra + 2 ^ bitsa - 1}
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>s. True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> (\<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True))\<rbrace>
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and (if is_device_untyped_cap capa then \<lambda>s. valid_idle s \<and> (fst cref \<noteq> idle_thread s \<and> valid_etcbs s) \<and> True else (\<lambda>a. valid_idle a \<and> fst cref \<noteq> idle_thread a \<and> valid_etcbs a \<and> True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ((\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) a) and (\<lambda>s. \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa))) s)\<rbrace>
 4. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 5. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 6. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 7. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (7 subgoals):
 1. \<And>s' dev r bits f x deva ra bitsa fa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); 0 < free_index_of (cap.UntypedCap False ra bitsa fa); x \<turnstile> cap.UntypedCap False ra bitsa fa; \<not> deva; \<not> bitsa < resetChunkBits; cap_aligned (cap.UntypedCap False ra bitsa fa); 2 < bitsa; free_index_of (cap.UntypedCap False ra bitsa fa) \<le> 2 ^ bitsa\<rbrakk> \<Longrightarrow> filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap False ra bitsa fa)) [0..<2 ^ (bitsa - resetChunkBits)] \<noteq> [] \<and> last (map (\<lambda>i. free_range_of_untyped (i * 2 ^ resetChunkBits) bitsa ra) (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap False ra bitsa fa)) [0..<2 ^ (bitsa - resetChunkBits)]))) = {ra..ra + 2 ^ bitsa - 1} \<and> (\<forall>x. x < 2 ^ (bitsa - resetChunkBits) \<and> x * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap False ra bitsa fa) \<longrightarrow> is_aligned ra bitsa \<and> bitsa < size ra \<and> x * 2 ^ resetChunkBits < fa \<and> free_range_of_untyped 0 bitsa ra \<subseteq> {ra..ra + 2 ^ bitsa - 1})
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>s. True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> (\<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True))\<rbrace>
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and (if is_device_untyped_cap capa then \<lambda>s. valid_idle s \<and> (fst cref \<noteq> idle_thread s \<and> valid_etcbs s) \<and> True else (\<lambda>a. valid_idle a \<and> fst cref \<noteq> idle_thread a \<and> valid_etcbs a \<and> True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ((\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) a) and (\<lambda>s. \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa))) s)\<rbrace>
 4. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 5. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 6. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 7. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (7 subgoals):
 1. \<And>s' dev r bits f x deva ra bitsa fa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); 0 < free_index_of (cap.UntypedCap False ra bitsa fa); x \<turnstile> cap.UntypedCap False ra bitsa fa; \<not> deva; \<not> bitsa < resetChunkBits; 2 < bitsa; free_index_of (cap.UntypedCap False ra bitsa fa) \<le> 2 ^ bitsa; is_aligned ra bitsa; bitsa < 32\<rbrakk> \<Longrightarrow> free_range_of_untyped 0 bitsa ra = {ra..ra + 2 ^ bitsa - 1} \<and> (\<forall>x. x < 2 ^ (bitsa - resetChunkBits) \<and> x * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap False ra bitsa fa) \<longrightarrow> x * 2 ^ resetChunkBits < fa \<and> free_range_of_untyped 0 bitsa ra \<subseteq> {ra..ra + 2 ^ bitsa - 1})
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>s. True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> (\<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True))\<rbrace>
 3. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and (if is_device_untyped_cap capa then \<lambda>s. valid_idle s \<and> (fst cref \<noteq> idle_thread s \<and> valid_etcbs s) \<and> True else (\<lambda>a. valid_idle a \<and> fst cref \<noteq> idle_thread a \<and> valid_etcbs a \<and> True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ((\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) a) and (\<lambda>s. \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa))) s)\<rbrace>
 4. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 5. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 6. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 7. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (6 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and ((\<lambda>_. True) and (\<lambda>s. True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> (\<forall>x\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). True))\<rbrace>
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and (if is_device_untyped_cap capa then \<lambda>s. valid_idle s \<and> (fst cref \<noteq> idle_thread s \<and> valid_etcbs s) \<and> True else (\<lambda>a. valid_idle a \<and> fst cref \<noteq> idle_thread a \<and> valid_etcbs a \<and> True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ((\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) a) and (\<lambda>s. \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa))) s)\<rbrace>
 3. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 4. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 5. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 6. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (6 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; 0 < free_index_of capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q101 s' dev r bits f (transform_cap capa)\<rbrace> modify (Untyped_D.detype (cap_objects (transform_cap capa))) \<lbrace>\<lambda>x s. True\<rbrace>
 2. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and (if is_device_untyped_cap capa then \<lambda>s. valid_idle s \<and> (fst cref \<noteq> idle_thread s \<and> valid_etcbs s) \<and> True else (\<lambda>a. valid_idle a \<and> fst cref \<noteq> idle_thread a \<and> valid_etcbs a \<and> True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ((\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) a) and (\<lambda>s. \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa))) s)\<rbrace>
 3. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and ?Q101 s' dev r bits f a\<rbrace>
 4. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 5. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 6. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (5 subgoals):
 1. \<And>s' dev r bits f cap capa. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cap = transform_cap capa; Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa; free_index_of capa \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q'98 s' dev r bits f capa\<rbrace> delete_objects (obj_ref_of capa) (bits_of capa) \<lbrace>\<lambda>x s. (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits \<longrightarrow> ((\<lambda>a. (\<not> is_device_untyped_cap capa \<longrightarrow> (pspace_no_overlap {obj_ref_of capa..obj_ref_of capa + 2 ^ bits_of capa - 1} and valid_objs and valid_etcbs) a) \<and> (is_device_untyped_cap capa \<longrightarrow> True)) and (if is_device_untyped_cap capa then \<lambda>s. valid_idle s \<and> (fst cref \<noteq> idle_thread s \<and> valid_etcbs s) \<and> True else (\<lambda>a. valid_idle a \<and> fst cref \<noteq> idle_thread a \<and> valid_etcbs a \<and> True))) s) \<and> (\<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<longrightarrow> ((\<lambda>a. \<forall>y\<in>set (rev (filter (\<lambda>i. i * 2 ^ resetChunkBits < free_index_of capa) [0..<2 ^ (bits_of capa - resetChunkBits)])). (valid_objs and valid_etcbs and pspace_no_overlap (untyped_range capa) and valid_idle and (\<lambda>s. idle_thread s \<noteq> fst cref) and cte_wp_at (\<lambda>cp. \<exists>idx. cp = free_index_update (\<lambda>_. idx) capa) cref) a) and (\<lambda>s. \<not> (is_device_untyped_cap capa \<or> bits_of capa < resetChunkBits) \<and> (\<exists>s. s \<turnstile> capa))) s)\<rbrace>
 2. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q22 s' dev r bits f\<rbrace> KHeap_D.get_cap (transform_cslot_ptr cref) \<lbrace>\<lambda>a. if available_range a = cap_objects a then \<lambda>a. True else (\<lambda>a. True) and (\<lambda>a. True)\<rbrace>
 3. \<And>s' dev r bits f. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'22 s' dev r bits f\<rbrace> CSpaceAcc_A.get_cap cref \<lbrace>\<lambda>capa. (if free_index_of capa = 0 then \<lambda>a. True else (\<lambda>a. invs a \<and> ct_active a \<and> (\<exists>cref dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx)) cref a \<and> descendants_range (cap.UntypedCap dev (obj_ref_of capa) (bits_of capa) idx) cref a) \<and> valid_etcbs a) and ?Q'98 s' dev r bits f capa and (\<lambda>s. free_index_of capa \<noteq> 0)) and (\<lambda>s. Structures_A.is_untyped_cap capa \<and> cap_aligned capa \<and> 2 < bits_of capa \<and> free_index_of capa \<le> 2 ^ bits_of capa)\<rbrace>
 4. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q22 s' dev r bits f) s
 5. \<And>s' dev r bits f s. \<lbrakk>invs s'; valid_etcbs s'; ct_active s'; CSpaceAcc_A.descendants_of cref (cdt s') = {}; caps_of_state s' cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst cref) and valid_etcbs and ?Q'22 s' dev r bits f) s proof (prove)
goal (1 subgoal):
 1. \<And>s' dev r bits f s. \<lbrakk>invs s; valid_etcbs s; ct_active s; CSpaceAcc_A.descendants_of cref (cdt s) = {}; caps_of_state s cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); s' = s\<rbrakk> \<Longrightarrow> not_idle_thread (fst cref) s \<and> (\<forall>x. (free_index_of x = 0 \<longrightarrow> cte_wp_at ((=) x) cref s \<longrightarrow> Structures_A.is_untyped_cap x \<and> cap_aligned x \<and> 2 < bits_of x) \<and> (0 < free_index_of x \<longrightarrow> cte_wp_at ((=) x) cref s \<longrightarrow> (\<exists>a b dev idx. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of x) (bits_of x) idx)) (a, b) s \<and> descendants_range (cap.UntypedCap dev (obj_ref_of x) (bits_of x) idx) (a, b) s) \<and> (is_device_untyped_cap x \<longrightarrow> (\<exists>a b dev f. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of x) (bits_of x) f)) (a, b) s \<and> descendants_range (cap.UntypedCap dev (obj_ref_of x) (bits_of x) f) (a, b) s) \<and> fst cref \<noteq> idle_thread s) \<and> (bits_of x < resetChunkBits \<longrightarrow> (\<not> is_device_untyped_cap x \<longrightarrow> (\<exists>dev idx. s \<turnstile> cap.UntypedCap dev (obj_ref_of x) (bits_of x) idx) \<and> pspace_aligned s \<and> (\<exists>a b dev f. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of x) (bits_of x) f)) (a, b) s \<and> descendants_range (cap.UntypedCap dev (obj_ref_of x) (bits_of x) f) (a, b) s)) \<and> (\<exists>a b dev f. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of x) (bits_of x) f)) (a, b) s \<and> descendants_range (cap.UntypedCap dev (obj_ref_of x) (bits_of x) f) (a, b) s) \<and> fst cref \<noteq> idle_thread s) \<and> (\<not> is_device_untyped_cap x \<and> \<not> bits_of x < resetChunkBits \<longrightarrow> ((\<exists>y<2 ^ (bits_of x - resetChunkBits). y * 2 ^ resetChunkBits < free_index_of x) \<longrightarrow> (\<exists>a b dev f. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of x) (bits_of x) f)) (a, b) s \<and> descendants_range (cap.UntypedCap dev (obj_ref_of x) (bits_of x) f) (a, b) s) \<and> (\<exists>dev idx. s \<turnstile> cap.UntypedCap dev (obj_ref_of x) (bits_of x) idx) \<and> pspace_aligned s \<and> untyped_range x = {obj_ref_of x..obj_ref_of x + 2 ^ bits_of x - 1} \<and> (\<exists>a b dev f. cte_wp_at ((=) (cap.UntypedCap dev (obj_ref_of x) (bits_of x) f)) (a, b) s \<and> descendants_range (cap.UntypedCap dev (obj_ref_of x) (bits_of x) f) (a, b) s) \<and> idle_thread s \<noteq> fst cref \<and> cte_wp_at (\<lambda>a. \<exists>idx. a = free_index_update (\<lambda>_. idx) x) cref s \<and> (obj_ref_of x \<le> fst cref \<longrightarrow> \<not> fst cref \<le> obj_ref_of x + 2 ^ bits_of x - 1)) \<and> Ex (valid_cap x)) \<and> Structures_A.is_untyped_cap x \<and> cap_aligned x \<and> 2 < bits_of x \<and> free_index_of x \<le> 2 ^ bits_of x)) proof (prove)
goal (1 subgoal):
 1. \<And>dev r bits f s. \<lbrakk>invs s; valid_etcbs s; ct_active s; CSpaceAcc_A.descendants_of cref (cdt s) = {}; caps_of_state s cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> not_idle_thread (fst cref) s \<and> (\<forall>x. (free_index_of x = 0 \<longrightarrow> x = cap.UntypedCap dev r bits f \<longrightarrow> cap_aligned (cap.UntypedCap dev r bits f) \<and> 2 < bits_of (cap.UntypedCap dev r bits f)) \<and> (0 < free_index_of x \<longrightarrow> x = cap.UntypedCap dev r bits f \<longrightarrow> (\<exists>a b. (\<exists>deva idx. caps_of_state s (a, b) = Some (cap.UntypedCap deva r (bits_of (cap.UntypedCap dev r bits f)) idx)) \<and> descendants_range_in {r..r + 2 ^ bits_of (cap.UntypedCap dev r bits f) - 1} (a, b) s) \<and> (dev \<longrightarrow> (\<exists>a b. (\<exists>dev fa. caps_of_state s (a, b) = Some (cap.UntypedCap dev r (bits_of (cap.UntypedCap True r bits f)) fa)) \<and> descendants_range_in {r..r + 2 ^ bits_of (cap.UntypedCap True r bits f) - 1} (a, b) s) \<and> fst cref \<noteq> idle_thread s) \<and> (bits_of (cap.UntypedCap dev r bits f) < resetChunkBits \<longrightarrow> (\<not> dev \<longrightarrow> (\<exists>dev idx. s \<turnstile> cap.UntypedCap dev r (bits_of (cap.UntypedCap False r bits f)) idx) \<and> pspace_aligned s \<and> (\<exists>a b. (\<exists>dev fa. caps_of_state s (a, b) = Some (cap.UntypedCap dev r (bits_of (cap.UntypedCap False r bits f)) fa)) \<and> descendants_range_in {r..r + 2 ^ bits_of (cap.UntypedCap False r bits f) - 1} (a, b) s)) \<and> (\<exists>a b. (\<exists>deva fa. caps_of_state s (a, b) = Some (cap.UntypedCap deva r (bits_of (cap.UntypedCap dev r bits f)) fa)) \<and> descendants_range_in {r..r + 2 ^ bits_of (cap.UntypedCap dev r bits f) - 1} (a, b) s) \<and> fst cref \<noteq> idle_thread s) \<and> (\<not> dev \<and> \<not> bits_of (cap.UntypedCap dev r bits f) < resetChunkBits \<longrightarrow> ((\<exists>y<2 ^ (bits_of (cap.UntypedCap False r bits f) - resetChunkBits). y * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap False r bits f)) \<longrightarrow> (\<exists>a b. (\<exists>dev fa. caps_of_state s (a, b) = Some (cap.UntypedCap dev r (bits_of (cap.UntypedCap False r bits f)) fa)) \<and> descendants_range_in {r..r + 2 ^ bits_of (cap.UntypedCap False r bits f) - 1} (a, b) s) \<and> (\<exists>dev idx. s \<turnstile> cap.UntypedCap dev r (bits_of (cap.UntypedCap False r bits f)) idx) \<and> pspace_aligned s \<and> (2 ^ bits = 2 ^ bits_of (cap.UntypedCap False r bits f) \<or> \<not> r \<le> r + 2 ^ bits - 1 \<and> \<not> r \<le> r + 2 ^ bits_of (cap.UntypedCap False r bits f) - 1) \<and> (\<exists>a b. (\<exists>dev fa. caps_of_state s (a, b) = Some (cap.UntypedCap dev r (bits_of (cap.UntypedCap False r bits f)) fa)) \<and> descendants_range_in {r..r + 2 ^ bits_of (cap.UntypedCap False r bits f) - 1} (a, b) s) \<and> idle_thread s \<noteq> fst cref \<and> (r \<le> fst cref \<longrightarrow> \<not> fst cref \<le> r + 2 ^ bits_of (cap.UntypedCap False r bits f) - 1)) \<and> Ex (valid_cap (cap.UntypedCap False r bits f))) \<and> cap_aligned (cap.UntypedCap dev r bits f) \<and> 2 < bits_of (cap.UntypedCap dev r bits f) \<and> free_index_of (cap.UntypedCap dev r bits f) \<le> 2 ^ bits_of (cap.UntypedCap dev r bits f))) proof (prove)
goal (1 subgoal):
 1. \<And>dev r bits f s. \<lbrakk>invs s; valid_etcbs s; ct_active s; CSpaceAcc_A.descendants_of cref (cdt s) = {}; caps_of_state s cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> not_idle_thread (fst cref) s \<and> (\<forall>x. (free_index_of x = 0 \<longrightarrow> x = cap.UntypedCap dev r bits f \<longrightarrow> cap_aligned (cap.UntypedCap dev r bits f) \<and> 2 < bits_of (cap.UntypedCap dev r bits f)) \<and> (0 < free_index_of x \<longrightarrow> x = cap.UntypedCap dev r bits f \<longrightarrow> bits = bits_of (cap.UntypedCap dev r bits f) \<and> (dev \<longrightarrow> bits = bits_of (cap.UntypedCap True r bits f) \<and> fst cref \<noteq> idle_thread s) \<and> (bits_of (cap.UntypedCap dev r bits f) < resetChunkBits \<longrightarrow> (\<not> dev \<longrightarrow> (\<exists>dev idx. s \<turnstile> cap.UntypedCap dev r (bits_of (cap.UntypedCap False r bits f)) idx) \<and> pspace_aligned s \<and> bits = bits_of (cap.UntypedCap False r bits f)) \<and> bits = bits_of (cap.UntypedCap dev r bits f) \<and> fst cref \<noteq> idle_thread s) \<and> (\<not> dev \<and> \<not> bits_of (cap.UntypedCap dev r bits f) < resetChunkBits \<longrightarrow> ((\<exists>y<2 ^ (bits_of (cap.UntypedCap False r bits f) - resetChunkBits). y * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap False r bits f)) \<longrightarrow> bits = bits_of (cap.UntypedCap False r bits f) \<and> (\<exists>dev idx. s \<turnstile> cap.UntypedCap dev r (bits_of (cap.UntypedCap False r bits f)) idx) \<and> pspace_aligned s \<and> (2 ^ bits = 2 ^ bits_of (cap.UntypedCap False r bits f) \<or> \<not> r \<le> r + 2 ^ bits - 1 \<and> \<not> r \<le> r + 2 ^ bits_of (cap.UntypedCap False r bits f) - 1) \<and> bits = bits_of (cap.UntypedCap False r bits f) \<and> idle_thread s \<noteq> fst cref \<and> (r \<le> fst cref \<longrightarrow> \<not> fst cref \<le> r + 2 ^ bits_of (cap.UntypedCap False r bits f) - 1)) \<and> Ex (valid_cap (cap.UntypedCap False r bits f))) \<and> cap_aligned (cap.UntypedCap dev r bits f) \<and> 2 < bits_of (cap.UntypedCap dev r bits f) \<and> free_index_of (cap.UntypedCap dev r bits f) \<le> 2 ^ bits_of (cap.UntypedCap dev r bits f))) proof (prove)
goal (1 subgoal):
 1. \<And>dev r bits f s a b. \<lbrakk>invs s; valid_etcbs s; ct_active s; CSpaceAcc_A.descendants_of cref (cdt s) = {}; caps_of_state s cref = Some (cap.UntypedCap dev r bits f); idx = free_index_of (cap.UntypedCap dev r bits f); cref = (a, b)\<rbrakk> \<Longrightarrow> not_idle_thread (fst cref) s \<and> (\<forall>x. (free_index_of x = 0 \<longrightarrow> x = cap.UntypedCap dev r bits f \<longrightarrow> cap_aligned (cap.UntypedCap dev r bits f) \<and> 2 < bits_of (cap.UntypedCap dev r bits f)) \<and> (0 < free_index_of x \<longrightarrow> x = cap.UntypedCap dev r bits f \<longrightarrow> bits = bits_of (cap.UntypedCap dev r bits f) \<and> (dev \<longrightarrow> bits = bits_of (cap.UntypedCap True r bits f) \<and> fst cref \<noteq> idle_thread s) \<and> (bits_of (cap.UntypedCap dev r bits f) < resetChunkBits \<longrightarrow> (\<not> dev \<longrightarrow> (\<exists>dev idx. s \<turnstile> cap.UntypedCap dev r (bits_of (cap.UntypedCap False r bits f)) idx) \<and> pspace_aligned s \<and> bits = bits_of (cap.UntypedCap False r bits f)) \<and> bits = bits_of (cap.UntypedCap dev r bits f) \<and> fst cref \<noteq> idle_thread s) \<and> (\<not> dev \<and> \<not> bits_of (cap.UntypedCap dev r bits f) < resetChunkBits \<longrightarrow> ((\<exists>y<2 ^ (bits_of (cap.UntypedCap False r bits f) - resetChunkBits). y * 2 ^ resetChunkBits < free_index_of (cap.UntypedCap False r bits f)) \<longrightarrow> bits = bits_of (cap.UntypedCap False r bits f) \<and> (\<exists>dev idx. s \<turnstile> cap.UntypedCap dev r (bits_of (cap.UntypedCap False r bits f)) idx) \<and> pspace_aligned s \<and> (2 ^ bits = 2 ^ bits_of (cap.UntypedCap False r bits f) \<or> \<not> r \<le> r + 2 ^ bits - 1 \<and> \<not> r \<le> r + 2 ^ bits_of (cap.UntypedCap False r bits f) - 1) \<and> bits = bits_of (cap.UntypedCap False r bits f) \<and> idle_thread s \<noteq> fst cref \<and> (r \<le> fst cref \<longrightarrow> \<not> fst cref \<le> r + 2 ^ bits_of (cap.UntypedCap False r bits f) - 1)) \<and> Ex (valid_cap (cap.UntypedCap False r bits f))) \<and> cap_aligned (cap.UntypedCap dev r bits f) \<and> 2 < bits_of (cap.UntypedCap dev r bits f) \<and> free_index_of (cap.UntypedCap dev r bits f) \<le> 2 ^ bits_of (cap.UntypedCap dev r bits f))) proof (prove)
goal (1 subgoal):
 1. \<And>dev r bits s a b. \<lbrakk>invs s; valid_etcbs s; ct_active s; CSpaceAcc_A.descendants_of (a, b) (cdt s) = {}; caps_of_state s (a, b) = Some (cap.UntypedCap dev r bits idx); cref = (a, b)\<rbrakk> \<Longrightarrow> not_idle_thread a s \<and> (\<forall>x. ((case x of cap.UntypedCap x xa xb free_index \<Rightarrow> free_index) = 0 \<longrightarrow> x = cap.UntypedCap dev r bits idx \<longrightarrow> cap_aligned (cap.UntypedCap dev r bits idx) \<and> 2 < bits) \<and> (0 < (case x of cap.UntypedCap x xa xb free_index \<Rightarrow> free_index) \<longrightarrow> x = cap.UntypedCap dev r bits idx \<longrightarrow> (dev \<longrightarrow> a \<noteq> idle_thread s) \<and> (bits < resetChunkBits \<longrightarrow> (\<not> dev \<longrightarrow> (\<exists>dev idx. s \<turnstile> cap.UntypedCap dev r bits idx) \<and> pspace_aligned s) \<and> a \<noteq> idle_thread s) \<and> (\<not> dev \<and> \<not> bits < resetChunkBits \<longrightarrow> ((\<exists>y<2 ^ (bits - resetChunkBits). y * 2 ^ resetChunkBits < idx) \<longrightarrow> (\<exists>dev idx. s \<turnstile> cap.UntypedCap dev r bits idx) \<and> pspace_aligned s \<and> idle_thread s \<noteq> a \<and> (r \<le> a \<longrightarrow> \<not> a \<le> r + 2 ^ bits - 1)) \<and> Ex (valid_cap (cap.UntypedCap False r bits idx))) \<and> cap_aligned (cap.UntypedCap dev r bits idx) \<and> 2 < bits \<and> idx \<le> 2 ^ bits)) proof (prove)
goal (1 subgoal):
 1. \<And>dev r bits s a b. \<lbrakk>invs s; valid_etcbs s; ct_active s; CSpaceAcc_A.descendants_of (a, b) (cdt s) = {}; caps_of_state s (a, b) = Some (cap.UntypedCap dev r bits idx); cref = (a, b); s \<turnstile> cap.UntypedCap dev r bits idx\<rbrakk> \<Longrightarrow> not_idle_thread a s \<and> (\<forall>x. ((case x of cap.UntypedCap x xa xb free_index \<Rightarrow> free_index) = 0 \<longrightarrow> x = cap.UntypedCap dev r bits idx \<longrightarrow> cap_aligned (cap.UntypedCap dev r bits idx) \<and> 2 < bits) \<and> (0 < (case x of cap.UntypedCap x xa xb free_index \<Rightarrow> free_index) \<longrightarrow> x = cap.UntypedCap dev r bits idx \<longrightarrow> (dev \<longrightarrow> a \<noteq> idle_thread s) \<and> (bits < resetChunkBits \<longrightarrow> (\<not> dev \<longrightarrow> (\<exists>dev idx. s \<turnstile> cap.UntypedCap dev r bits idx) \<and> pspace_aligned s) \<and> a \<noteq> idle_thread s) \<and> (\<not> dev \<and> \<not> bits < resetChunkBits \<longrightarrow> ((\<exists>y<2 ^ (bits - resetChunkBits). y * 2 ^ resetChunkBits < idx) \<longrightarrow> (\<exists>dev idx. s \<turnstile> cap.UntypedCap dev r bits idx) \<and> pspace_aligned s \<and> idle_thread s \<noteq> a \<and> (r \<le> a \<longrightarrow> \<not> a \<le> r + 2 ^ bits - 1)) \<and> Ex (valid_cap (cap.UntypedCap False r bits idx))) \<and> cap_aligned (cap.UntypedCap dev r bits idx) \<and> 2 < bits \<and> idx \<le> 2 ^ bits)) proof (prove)
goal (1 subgoal):
 1. \<And>dev r bits s a b. \<lbrakk>invs s; valid_etcbs s; ct_active s; CSpaceAcc_A.descendants_of (a, b) (cdt s) = {}; caps_of_state s (a, b) = Some (cap.UntypedCap dev r bits idx); cref = (a, b); cap_aligned (cap.UntypedCap dev r bits idx); valid_untyped (cap.UntypedCap dev r bits idx) s; untyped_min_bits \<le> bits; idx \<le> 2 ^ bits; r \<noteq> 0\<rbrakk> \<Longrightarrow> not_idle_thread a s \<and> (\<forall>x. ((case x of cap.UntypedCap x xa xb free_index \<Rightarrow> free_index) = 0 \<longrightarrow> x = cap.UntypedCap dev r bits idx \<longrightarrow> 2 < bits) \<and> (0 < (case x of cap.UntypedCap x xa xb free_index \<Rightarrow> free_index) \<longrightarrow> x = cap.UntypedCap dev r bits idx \<longrightarrow> (dev \<longrightarrow> a \<noteq> idle_thread s) \<and> (bits < resetChunkBits \<longrightarrow> (\<not> dev \<longrightarrow> (\<exists>dev idx. cap_aligned (cap.UntypedCap dev r bits idx) \<and> valid_untyped (cap.UntypedCap dev r bits idx) s \<and> idx \<le> 2 ^ bits) \<and> pspace_aligned s) \<and> a \<noteq> idle_thread s) \<and> (\<not> dev \<and> \<not> bits < resetChunkBits \<longrightarrow> ((\<exists>y<2 ^ (bits - resetChunkBits). y * 2 ^ resetChunkBits < idx) \<longrightarrow> (\<exists>dev idx. cap_aligned (cap.UntypedCap dev r bits idx) \<and> valid_untyped (cap.UntypedCap dev r bits idx) s \<and> idx \<le> 2 ^ bits) \<and> pspace_aligned s \<and> idle_thread s \<noteq> a \<and> (r \<le> a \<longrightarrow> \<not> a \<le> r + 2 ^ bits - 1)) \<and> Ex (valid_cap (cap.UntypedCap False r bits idx))) \<and> 2 < bits)) proof (prove)
goal (1 subgoal):
 1. \<And>dev r bits s a b. \<lbrakk>invs s; valid_etcbs s; ct_active s; CSpaceAcc_A.descendants_of (a, b) (cdt s) = {}; caps_of_state s (a, b) = Some (cap.UntypedCap dev r bits idx); cref = (a, b); cap_aligned (cap.UntypedCap dev r bits idx); valid_untyped (cap.UntypedCap dev r bits idx) s; untyped_min_bits \<le> bits; idx \<le> 2 ^ bits; r \<noteq> 0; ex_cte_cap_wp_to (appropriate_cte_cap (cap.UntypedCap dev r bits idx)) (a, b) s\<rbrakk> \<Longrightarrow> not_idle_thread a s \<and> (\<forall>x. ((case x of cap.UntypedCap x xa xb free_index \<Rightarrow> free_index) = 0 \<longrightarrow> x = cap.UntypedCap dev r bits idx \<longrightarrow> 2 < bits) \<and> (0 < (case x of cap.UntypedCap x xa xb free_index \<Rightarrow> free_index) \<longrightarrow> x = cap.UntypedCap dev r bits idx \<longrightarrow> (dev \<longrightarrow> a \<noteq> idle_thread s) \<and> (bits < resetChunkBits \<longrightarrow> (\<not> dev \<longrightarrow> (\<exists>dev idx. cap_aligned (cap.UntypedCap dev r bits idx) \<and> valid_untyped (cap.UntypedCap dev r bits idx) s \<and> idx \<le> 2 ^ bits) \<and> pspace_aligned s) \<and> a \<noteq> idle_thread s) \<and> (\<not> dev \<and> \<not> bits < resetChunkBits \<longrightarrow> ((\<exists>y<2 ^ (bits - resetChunkBits). y * 2 ^ resetChunkBits < idx) \<longrightarrow> (\<exists>dev idx. cap_aligned (cap.UntypedCap dev r bits idx) \<and> valid_untyped (cap.UntypedCap dev r bits idx) s \<and> idx \<le> 2 ^ bits) \<and> pspace_aligned s \<and> idle_thread s \<noteq> a \<and> (r \<le> a \<longrightarrow> \<not> a \<le> r + 2 ^ bits - 1)) \<and> Ex (valid_cap (cap.UntypedCap False r bits idx))) \<and> 2 < bits)) proof (prove)
goal (1 subgoal):
 1. \<And>dev r bits s a b. \<lbrakk>invs s; valid_etcbs s; ct_active s; CSpaceAcc_A.descendants_of (a, b) (cdt s) = {}; caps_of_state s (a, b) = Some (cap.UntypedCap dev r bits idx); cref = (a, b); cap_aligned (cap.UntypedCap dev r bits idx); valid_untyped (cap.UntypedCap dev r bits idx) s; untyped_min_bits \<le> bits; idx \<le> 2 ^ bits; r \<noteq> 0; ex_cte_cap_wp_to (appropriate_cte_cap (cap.UntypedCap dev r bits idx)) (a, b) s; r \<le> a \<longrightarrow> \<not> a \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> not_idle_thread a s \<and> (\<forall>x. ((case x of cap.UntypedCap x xa xb free_index \<Rightarrow> free_index) = 0 \<longrightarrow> x = cap.UntypedCap dev r bits idx \<longrightarrow> 2 < bits) \<and> (0 < (case x of cap.UntypedCap x xa xb free_index \<Rightarrow> free_index) \<longrightarrow> x = cap.UntypedCap dev r bits idx \<longrightarrow> (dev \<longrightarrow> a \<noteq> idle_thread s) \<and> (bits < resetChunkBits \<longrightarrow> (\<not> dev \<longrightarrow> (\<exists>dev idx. cap_aligned (cap.UntypedCap dev r bits idx) \<and> valid_untyped (cap.UntypedCap dev r bits idx) s \<and> idx \<le> 2 ^ bits) \<and> pspace_aligned s) \<and> a \<noteq> idle_thread s) \<and> (\<not> dev \<and> \<not> bits < resetChunkBits \<longrightarrow> ((\<exists>y<2 ^ (bits - resetChunkBits). y * 2 ^ resetChunkBits < idx) \<longrightarrow> (\<exists>dev idx. cap_aligned (cap.UntypedCap dev r bits idx) \<and> valid_untyped (cap.UntypedCap dev r bits idx) s \<and> idx \<le> 2 ^ bits) \<and> pspace_aligned s \<and> idle_thread s \<noteq> a) \<and> Ex (valid_cap (cap.UntypedCap False r bits idx))) \<and> 2 < bits)) proof (prove)
goal:
No subgoals!