theory CSpace_C

lemma update_freeIndex':
  assumes i'_align: "is_aligned (of_nat i' :: machine_word) minUntypedSizeBits"
  assumes sz_bound: "sz \<le> maxUntypedSizeBits"
  assumes i'_bound: "i' \<le> 2 ^ sz"
  shows "ccorres dc xfdc
           (cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = UntypedCap d p sz i) srcSlot)
           (UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rbrace>
                 \<inter> \<lbrace>\<acute>v32 = of_nat i' >> minUntypedSizeBits\<rbrace>) []
           (updateCap srcSlot (UntypedCap d p sz i'))
           (Call cap_untyped_cap_ptr_set_capFreeIndex_'proc)" proof - note i'_bound_concrete
      = order_trans[OF i'_bound power_increasing[OF sz_bound], simplified untypedBits_defs, simplified] have i'_bound_word: "(of_nat i' :: machine_word) \<le> 2 ^ maxUntypedSizeBits" using order_trans[OF i'_bound power_increasing[OF sz_bound], simplified] by (simp add: word_of_nat_le untypedBits_defs) show ?thesis supply if_cong[cong] apply (cinit lift: cap_ptr_' v32_') apply (rule ccorres_pre_getCTE) apply (rule_tac P="\<lambda>s. ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = UntypedCap d p sz i)"
                in ccorres_from_vcg[where P' = UNIV]) apply (rule allI) apply (rule conseqPre) apply vcg apply (clarsimp simp: guard_simps) apply (intro conjI) apply (frule (1) rf_sr_ctes_of_clift) apply (clarsimp simp: typ_heap_simps) apply (frule (1) rf_sr_ctes_of_clift) apply (clarsimp simp: split_def) apply (simp add: hrs_htd_def typ_heap_simps) apply (rule fst_setCTE[OF ctes_of_cte_at], assumption) apply (erule bexI[rotated], clarsimp) apply (frule (1) rf_sr_ctes_of_clift) apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def
                             cvariable_array_map_const_add_map_option[where f="tcb_no_ctes_proj"]) apply (simp add: cpspace_relation_def) apply (clarsimp simp: typ_heap_simps') apply (rule conjI) apply (erule (2) cpspace_cte_relation_upd_capI) apply (simp only: cte_lift_def split: option.splits; simp) apply (simp add: cap_to_H_def Let_def split: cap_CL.splits if_split_asm) apply (case_tac y) apply (simp add: cap_lift_def Let_def split: if_split_asm) apply (case_tac cte', simp) apply (clarsimp simp: ccap_relation_def cap_lift_def cap_get_tag_def cap_to_H_def) apply (thin_tac _)+ apply (simp add: mask_def to_bool_and_1 nth_shiftr word_ao_dist and.assoc) apply (rule inj_onD[OF word_unat.Abs_inj_on[where 'a=machine_word_len]], simp) apply (cut_tac i'_align i'_bound_word) apply (simp add: is_aligned_mask) apply word_bitwise subgoal by (simp add: word_size untypedBits_defs mask_def) apply (cut_tac i'_bound_concrete) subgoal by (simp add: unats_def) subgoal by (simp add: word_unat.Rep[where 'a=machine_word_len, simplified]) apply (erule_tac t = s' in ssubst) apply clarsimp apply (rule conjI) subgoal by (erule (1) setCTE_tcb_case) subgoal by (simp add: carch_state_relation_def cmachine_state_relation_def typ_heap_simps') by (clarsimp simp:cte_wp_at_ctes_of) qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot) (UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat i' >> minUntypedSizeBits\<rbrace>) [] (updateCap srcSlot (capability.UntypedCap d p sz i')) (Call cap_untyped_cap_ptr_set_capFreeIndex_'proc) proof (state)
goal (1 subgoal):
 1. ccorres dc xfdc (cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot) (UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat i' >> minUntypedSizeBits\<rbrace>) [] (updateCap srcSlot (capability.UntypedCap d p sz i')) (Call cap_untyped_cap_ptr_set_capFreeIndex_'proc) proof (state)
this:
i' \<le> 536870912

goal (1 subgoal):
 1. ccorres dc xfdc (cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot) (UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat i' >> minUntypedSizeBits\<rbrace>) [] (updateCap srcSlot (capability.UntypedCap d p sz i')) (Call cap_untyped_cap_ptr_set_capFreeIndex_'proc) proof (prove)
goal (1 subgoal):
 1. word_of_nat i' \<le> 2 ^ maxUntypedSizeBits proof (prove)
using this:
i' \<le> 2 ^ maxUntypedSizeBits

goal (1 subgoal):
 1. word_of_nat i' \<le> 2 ^ maxUntypedSizeBits proof (state)
this:
word_of_nat i' \<le> 2 ^ maxUntypedSizeBits

goal (1 subgoal):
 1. ccorres dc xfdc (cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot) (UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat i' >> minUntypedSizeBits\<rbrace>) [] (updateCap srcSlot (capability.UntypedCap d p sz i')) (Call cap_untyped_cap_ptr_set_capFreeIndex_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot) (UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat i' >> minUntypedSizeBits\<rbrace>) [] (updateCap srcSlot (capability.UntypedCap d p sz i')) (Call cap_untyped_cap_ptr_set_capFreeIndex_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot) (UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat i' >> minUntypedSizeBits\<rbrace>) [] (updateCap srcSlot (capability.UntypedCap d p sz i')) (Call cap_untyped_cap_ptr_set_capFreeIndex_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>v32 cap_ptr. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q344 v32 cap_ptr) (?Q'344 v32 cap_ptr) [SKIP] (do cte <- getCTE srcSlot;
setCTE srcSlot (cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') cte)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cap_ptr} (Guard C_Guard {s. s \<Turnstile>\<^sub>c cap_ptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])).[Suc 0] && 0x3F))))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cap_ptr} (Guard C_Guard {s. s \<Turnstile>\<^sub>c cap_ptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])).[Suc 0] || (v32 << 6) && 0xFFFFFFC0)))))))
 2. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q344 v32 cap_ptr s \<and> s' \<in> ?Q'344 v32 cap_ptr proof (prove)
goal (2 subgoals):
 1. \<And>v32 cap_ptr cte. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P350 v32 cap_ptr cte) (?P'350 v32 cap_ptr cte) [SKIP] (setCTE srcSlot (cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') cte)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cap_ptr} (Guard C_Guard {s. s \<Turnstile>\<^sub>c cap_ptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])).[Suc 0] && 0x3F))))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cap_ptr} (Guard C_Guard {s. s \<Turnstile>\<^sub>c cap_ptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])).[Suc 0] || (v32 << 6) && 0xFFFFFFC0)))))))
 2. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ?P350 v32 cap_ptr cte s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?P'350 v32 cap_ptr (cte_to_H cte')} proof (prove)
goal (2 subgoals):
 1. \<And>v32 cap_ptr cte. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (ctes_of \<sigma> srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} Guard C_Guard {s. s \<Turnstile>\<^sub>c cap_ptr} (Guard C_Guard {s. s \<Turnstile>\<^sub>c cap_ptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])).[Suc 0] && 0x3F))))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cap_ptr} (Guard C_Guard {s. s \<Turnstile>\<^sub>c cap_ptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])).[Suc 0] || (v32 << 6) && 0xFFFFFFC0)))))) {s. \<exists>(rv, \<sigma>')\<in>fst (setCTE srcSlot (cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') cte) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)}
 2. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>v32 cap_ptr cte \<sigma>. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. (ctes_of \<sigma> srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} Guard C_Guard {s. s \<Turnstile>\<^sub>c cap_ptr} (Guard C_Guard {s. s \<Turnstile>\<^sub>c cap_ptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])).[Suc 0] && 0x3F))))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cap_ptr} (Guard C_Guard {s. s \<Turnstile>\<^sub>c cap_ptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])).[Suc 0] || (v32 << 6) && 0xFFFFFFC0)))))) {s. \<exists>(rv, \<sigma>')\<in>fst (setCTE srcSlot (cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') cte) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)}
 2. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>v32 cap_ptr cte \<sigma>. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'356 v32 cap_ptr cte \<sigma>) Guard C_Guard {s. s \<Turnstile>\<^sub>c cap_ptr} (Guard C_Guard {s. s \<Turnstile>\<^sub>c cap_ptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])).[Suc 0] && 0x3F))))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cap_ptr} (Guard C_Guard {s. s \<Turnstile>\<^sub>c cap_ptr} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])).[Suc 0] || (v32 << 6) && 0xFFFFFFC0)))))) {s. \<exists>(rv, \<sigma>')\<in>fst (setCTE srcSlot (cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') cte) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)}
 2. \<And>v32 cap_ptr cte \<sigma>. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rbrakk> \<Longrightarrow> {s. (ctes_of \<sigma> srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> ?P'356 v32 cap_ptr cte \<sigma>
 3. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>v32 cap_ptr cte \<sigma>. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rbrakk> \<Longrightarrow> {s. (ctes_of \<sigma> srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. s \<Turnstile>\<^sub>c cap_ptr \<and> hrs_htd (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])).[Suc 0] && 0x3F))) (t_hrs_' (globals s))) \<Turnstile>\<^sub>t cap_ptr \<and> (\<exists>(rv, \<sigma>')\<in>fst (setCTE srcSlot (cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') cte) \<sigma>). (\<sigma>', globals_update (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])).[Suc 0] && 0x3F))) (t_hrs_' (globals s)))) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])).[Suc 0] && 0x3F))) (t_hrs_' (globals s)))) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])).[Suc 0] || (v32 << 6) && 0xFFFFFFC0))) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])).[Suc 0] && 0x3F))) x))) s) \<in> rf_sr \<and> dc rv (xfdc (globals_update (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])).[Suc 0] && 0x3F))) (t_hrs_' (globals s)))) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])).[Suc 0] && 0x3F))) (t_hrs_' (globals s)))) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])).[Suc 0] || (v32 << 6) && 0xFFFFFFC0))) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word[2]) &(cap_ptr\<rightarrow>[''words_C''])).[Suc 0] && 0x3F))) x))) s)))}
 2. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>cte \<sigma> x i. \<lbrakk>ctes_of \<sigma> srcSlot = Some cte; (\<sigma>, x) \<in> rf_sr; cteCap cte = capability.UntypedCap d p sz i\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']) \<and> (\<exists>xa\<in>fst (setCTE srcSlot (cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') cte) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', globals_update (t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])).[Suc 0] && 0x3F))) (t_hrs_' (globals x)))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])).[Suc 0] && 0x3F))) (t_hrs_' (globals x)))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])).[Suc 0] || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0))) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])).[Suc 0] && 0x3F))) xa))) x) \<in> rf_sr)
 2. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>cte \<sigma> x i. \<lbrakk>ctes_of \<sigma> srcSlot = Some cte; (\<sigma>, x) \<in> rf_sr; cteCap cte = capability.UntypedCap d p sz i\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])
 2. \<And>cte \<sigma> x i. \<lbrakk>ctes_of \<sigma> srcSlot = Some cte; (\<sigma>, x) \<in> rf_sr; cteCap cte = capability.UntypedCap d p sz i\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE srcSlot (cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') cte) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', globals_update (t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])).[Suc 0] && 0x3F))) (t_hrs_' (globals x)))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])).[Suc 0] && 0x3F))) (t_hrs_' (globals x)))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])).[Suc 0] || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0))) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])).[Suc 0] && 0x3F))) xa))) x) \<in> rf_sr
 3. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>cte \<sigma> x i. \<lbrakk>ctes_of \<sigma> srcSlot = Some cte; (\<sigma>, x) \<in> rf_sr; cteCap cte = capability.UntypedCap d p sz i; \<exists>cte'. cslift x (cte_Ptr srcSlot) = Some cte' \<and> cte_lift cte' \<noteq> None \<and> cte = cte_to_H (the (cte_lift cte')) \<and> c_valid_cte cte'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])
 2. \<And>cte \<sigma> x i. \<lbrakk>ctes_of \<sigma> srcSlot = Some cte; (\<sigma>, x) \<in> rf_sr; cteCap cte = capability.UntypedCap d p sz i\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE srcSlot (cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') cte) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', globals_update (t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])).[Suc 0] && 0x3F))) (t_hrs_' (globals x)))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])).[Suc 0] && 0x3F))) (t_hrs_' (globals x)))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])).[Suc 0] || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0))) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])).[Suc 0] && 0x3F))) xa))) x) \<in> rf_sr
 3. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>cte \<sigma> x i. \<lbrakk>ctes_of \<sigma> srcSlot = Some cte; (\<sigma>, x) \<in> rf_sr; cteCap cte = capability.UntypedCap d p sz i\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE srcSlot (cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') cte) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', globals_update (t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])).[Suc 0] && 0x3F))) (t_hrs_' (globals x)))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])).[Suc 0] && 0x3F))) (t_hrs_' (globals x)))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])).[Suc 0] || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0))) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])).[Suc 0] && 0x3F))) xa))) x) \<in> rf_sr
 2. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>cte \<sigma> x i. \<lbrakk>ctes_of \<sigma> srcSlot = Some cte; (\<sigma>, x) \<in> rf_sr; cteCap cte = capability.UntypedCap d p sz i; \<exists>cte'. cslift x (cte_Ptr srcSlot) = Some cte' \<and> cte_lift cte' \<noteq> None \<and> cte = cte_to_H (the (cte_lift cte')) \<and> c_valid_cte cte'\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE srcSlot (cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') cte) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', globals_update (t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])).[Suc 0] && 0x3F))) (t_hrs_' (globals x)))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])).[Suc 0] && 0x3F))) (t_hrs_' (globals x)))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])).[Suc 0] || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0))) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])).[Suc 0] && 0x3F))) xa))) x) \<in> rf_sr
 2. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x i cte' y. \<lbrakk>ctes_of \<sigma> srcSlot = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE srcSlot (cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)) \<sigma>). (snd xa, globals_update (t_hrs_'_update (\<lambda>xa. hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])).[Suc 0] && 0x3F))) (t_hrs_' (globals x)))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])).[Suc 0] && 0x3F))) (t_hrs_' (globals x)))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])).[Suc 0] || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0))) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C'']))) (Suc 0) (h_val (hrs_mem (t_hrs_' (globals x))) (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])).[Suc 0] && 0x3F))) xa))) x) \<in> rf_sr
 2. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x i cte' y. \<lbrakk>ctes_of \<sigma> srcSlot = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE srcSlot (cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)) \<sigma>). (snd xa, globals_update (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0))) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F))) x))) x) \<in> rf_sr
 2. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x i cte' y s'. \<lbrakk>ctes_of \<sigma> srcSlot = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; ((), s') \<in> fst (setCTE srcSlot (?cte407 \<sigma> x i cte' y) \<sigma>); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> ?cte407 \<sigma> x i cte' y); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE srcSlot (cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)) \<sigma>). (snd xa, globals_update (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0))) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F))) x))) x) \<in> rf_sr
 2. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x i cte' y s'. \<lbrakk>ctes_of \<sigma> srcSlot = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'\<rbrakk> \<Longrightarrow> (s', globals_update (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0))) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F))) x))) x) \<in> rf_sr
 2. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x i cte' y s'. \<lbrakk>ctes_of \<sigma> srcSlot = Some (cte_to_H y); (\<sigma>, x) \<in> rf_sr; cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; \<exists>cte'. cslift x (cte_Ptr srcSlot) = Some cte' \<and> cte_lift cte' \<noteq> None \<and> cte_to_H y = cte_to_H (the (cte_lift cte')) \<and> c_valid_cte cte'\<rbrakk> \<Longrightarrow> (s', globals_update (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0))) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F))) x))) x) \<in> rf_sr
 2. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x i cte' y s'. \<lbrakk>ctes_of \<sigma> srcSlot = Some (cte_to_H y); cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cpspace_relation (ksPSpace s') (underlying_memory (ksMachineState s')) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0))) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F))) (t_hrs_' (globals x)))) \<and> cready_queues_relation (clift (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0))) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F))) (t_hrs_' (globals x))))) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0))) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F))) (t_hrs_' (globals x)))) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0))) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F))) x)) (globals x)) \<and> cmachine_state_relation (ksMachineState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0))) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F))) x)) (globals x)) \<and> cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 2. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x i cte' y s'. \<lbrakk>ctes_of \<sigma> srcSlot = Some (cte_to_H y); cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation \<and> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)) \<and> cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)) \<and> cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr \<and> carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation ((ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y))) (clift (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0))) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F))) (t_hrs_' (globals x))))) cte_Ptr ccte_relation \<and> cpspace_tcb_relation (ksPSpace s') (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0))) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F))) (t_hrs_' (globals x)))) \<and> cmap_relation (map_to_eps (ksPSpace s')) (clift (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0))) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F))) (t_hrs_' (globals x))))) ep_Ptr (cendpoint_relation (clift (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0))) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F))) (t_hrs_' (globals x)))))) \<and> cmap_relation (map_to_ntfns (ksPSpace s')) (clift (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0))) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F))) (t_hrs_' (globals x))))) ntfn_Ptr (cnotification_relation (clift (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0))) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F))) (t_hrs_' (globals x)))))) \<and> cmap_relation (map_to_pdes (ksPSpace s')) (clift (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0))) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F))) (t_hrs_' (globals x))))) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ksPSpace s')) (clift (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0))) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F))) (t_hrs_' (globals x))))) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ksPSpace s')) (clift (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0))) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F))) (t_hrs_' (globals x))))) ap_Ptr casid_pool_relation \<and> cpspace_user_data_relation (ksPSpace s') (underlying_memory (ksMachineState s')) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0))) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F))) (t_hrs_' (globals x)))) \<and> cpspace_device_data_relation (ksPSpace s') (underlying_memory (ksMachineState s')) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0))) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F))) (t_hrs_' (globals x)))) \<and> cready_queues_relation (clift (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0))) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F))) (t_hrs_' (globals x))))) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0))) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F))) (t_hrs_' (globals x)))) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0))) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F))) x)) (globals x)) \<and> cmachine_state_relation (ksMachineState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0))) (hrs_mem_update (heap_update (PTR(32 word[2]) &(cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rightarrow>[''words_C''])) (Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F))) x)) (globals x)) \<and> cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 2. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x i cte' y s'. \<lbrakk>ctes_of \<sigma> srcSlot = Some (cte_to_H y); cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation ((ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y))) ((cslift x)(cte_Ptr srcSlot \<mapsto> cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (cte_C.cap_C cte')) cte')) cte_Ptr ccte_relation \<and> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cmachine_state_relation (ksMachineState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 2. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x i cte' y s'. \<lbrakk>ctes_of \<sigma> srcSlot = Some (cte_to_H y); cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation ((ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y))) ((cslift x)(cte_Ptr srcSlot \<mapsto> cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (cte_C.cap_C cte')) cte')) cte_Ptr ccte_relation
 2. \<And>\<sigma> x i cte' y s'. \<lbrakk>ctes_of \<sigma> srcSlot = Some (cte_to_H y); cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cmachine_state_relation (ksMachineState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 3. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x i cte' y s'. \<lbrakk>ctes_of \<sigma> srcSlot = Some (cte_to_H y); cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> ccap_relation (capability.UntypedCap d p sz i') (cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (cte_C.cap_C cte'))
 2. \<And>\<sigma> x i cte' y s'. \<lbrakk>ctes_of \<sigma> srcSlot = Some (cte_to_H y); cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cmachine_state_relation (ksMachineState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 3. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x i cte' y s' x2. \<lbrakk>c_valid_cte cte'; s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; ctes_of \<sigma> srcSlot = Some (cte_to_H y); cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cap_lift (cte_C.cap_C cte') = Some x2; \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C cte')\<rparr> = y\<rbrakk> \<Longrightarrow> ccap_relation (capability.UntypedCap d p sz i') (cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (cte_C.cap_C cte'))
 2. \<And>\<sigma> x i cte' y s'. \<lbrakk>ctes_of \<sigma> srcSlot = Some (cte_to_H y); cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cmachine_state_relation (ksMachineState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 3. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x cte' y s' x2 x2a. \<lbrakk>cslift x (cte_Ptr srcSlot) = Some cte'; cap_lift (cte_C.cap_C cte') = Some x2; \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C cte')\<rparr> = y; c_valid_cte cte'; s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; ctes_of \<sigma> srcSlot = Some (cte_to_H y); cap_CL y = Cap_untyped_cap x2a; to_bool (capIsDevice_CL x2a) = d \<and> capPtr_CL x2a = p \<and> unat (capBlockSize_CL x2a) = sz\<rbrakk> \<Longrightarrow> ccap_relation (capability.UntypedCap d p sz i') (cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (cte_C.cap_C cte'))
 2. \<And>\<sigma> x i cte' y s'. \<lbrakk>ctes_of \<sigma> srcSlot = Some (cte_to_H y); cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cmachine_state_relation (ksMachineState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 3. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x cte' y s' x2 x2a cap_CLa cteMDBNode_CL. \<lbrakk>cslift x (cte_Ptr srcSlot) = Some cte'; cap_lift (cte_C.cap_C cte') = Some x2; \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C cte')\<rparr> = y; c_valid_cte cte'; s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; ctes_of \<sigma> srcSlot = Some (cte_to_H y); cap_CL y = Cap_untyped_cap x2a; to_bool (capIsDevice_CL x2a) = d \<and> capPtr_CL x2a = p \<and> unat (capBlockSize_CL x2a) = sz; y = \<lparr>cap_CL = cap_CLa, cteMDBNode_CL = cteMDBNode_CL\<rparr>\<rbrakk> \<Longrightarrow> ccap_relation (capability.UntypedCap d p sz i') (cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (cte_C.cap_C cte'))
 2. \<And>\<sigma> x i cte' y s'. \<lbrakk>ctes_of \<sigma> srcSlot = Some (cte_to_H y); cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cmachine_state_relation (ksMachineState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 3. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x cte' y s' x2 x2a cap_CL. \<lbrakk>x2 = Cap_untyped_cap x2a; c_valid_cte cte'; s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H \<lparr>cap_CL = Cap_untyped_cap x2a, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C cte')\<rparr>)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; ctes_of \<sigma> srcSlot = Some (cte_to_H \<lparr>cap_CL = Cap_untyped_cap x2a, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C cte')\<rparr>); cap_CL = Cap_untyped_cap x2a; y = \<lparr>cap_CL = Cap_untyped_cap x2a, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C cte')\<rparr>; cslift x (cte_Ptr srcSlot) = Some cte'; cap_untyped_cap \<noteq> cap_null_cap; to_bool (capIsDevice_CL x2a) = d; capPtr_CL x2a = p; unat (capBlockSize_CL x2a) = sz; cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; \<lparr>capFreeIndex_CL = (cap_C.words_C (cte_C.cap_C cte').[Suc 0] >> 6) && mask 26, capIsDevice_CL = (cap_C.words_C (cte_C.cap_C cte').[Suc 0] >> 5) && 1, capBlockSize_CL = cap_C.words_C (cte_C.cap_C cte').[Suc 0] && mask 5, capPtr_CL = cap_C.words_C (cte_C.cap_C cte').[0] && ~~ mask 4\<rparr> = x2a\<rbrakk> \<Longrightarrow> ccap_relation (capability.UntypedCap d p sz i') (cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (cte_C.cap_C cte'))
 2. \<And>\<sigma> x i cte' y s'. \<lbrakk>ctes_of \<sigma> srcSlot = Some (cte_to_H y); cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cmachine_state_relation (ksMachineState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 3. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x cte' y s' x2 x2a cap_CL x1 x2b. \<lbrakk>x2 = Cap_untyped_cap x2a; c_valid_cte (cte_C x1 x2b); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H \<lparr>cap_CL = Cap_untyped_cap x2a, cteMDBNode_CL = mdb_node_lift x2b\<rparr>)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; ctes_of \<sigma> srcSlot = Some (cte_to_H \<lparr>cap_CL = Cap_untyped_cap x2a, cteMDBNode_CL = mdb_node_lift x2b\<rparr>); cap_CL = Cap_untyped_cap x2a; y = \<lparr>cap_CL = Cap_untyped_cap x2a, cteMDBNode_CL = mdb_node_lift x2b\<rparr>; cslift x (cte_Ptr srcSlot) = Some (cte_C x1 x2b); cap_untyped_cap \<noteq> cap_null_cap; to_bool (capIsDevice_CL x2a) = d; capPtr_CL x2a = p; unat (capBlockSize_CL x2a) = sz; cap_get_tag x1 = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; \<lparr>capFreeIndex_CL = (cap_C.words_C x1.[Suc 0] >> 6) && mask 26, capIsDevice_CL = (cap_C.words_C x1.[Suc 0] >> 5) && 1, capBlockSize_CL = cap_C.words_C x1.[Suc 0] && mask 5, capPtr_CL = cap_C.words_C x1.[0] && ~~ mask 4\<rparr> = x2a; cte' = cte_C x1 x2b\<rbrakk> \<Longrightarrow> ccap_relation (capability.UntypedCap d p sz i') (cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C x1) (Suc 0) (cap_C.words_C x1.[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) x1)
 2. \<And>\<sigma> x i cte' y s'. \<lbrakk>ctes_of \<sigma> srcSlot = Some (cte_to_H y); cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cmachine_state_relation (ksMachineState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 3. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x s' x1 x2b. \<lbrakk>c_valid_cte (cte_C x1 x2b); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap (to_bool ((cap_C.words_C x1.[Suc 0] >> 5) && 1)) (cap_C.words_C x1.[0] && ~~ mask 4) (unat (cap_C.words_C x1.[Suc 0] && mask 5)) i') (cte_to_H \<lparr>cap_CL = Cap_untyped_cap \<lparr>capFreeIndex_CL = (cap_C.words_C x1.[Suc 0] >> 6) && mask 26, capIsDevice_CL = (cap_C.words_C x1.[Suc 0] >> 5) && 1, capBlockSize_CL = cap_C.words_C x1.[Suc 0] && mask 5, capPtr_CL = cap_C.words_C x1.[0] && ~~ mask 4\<rparr>, cteMDBNode_CL = mdb_node_lift x2b\<rparr>)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; ctes_of \<sigma> srcSlot = Some (cte_to_H \<lparr>cap_CL = Cap_untyped_cap \<lparr>capFreeIndex_CL = (cap_C.words_C x1.[Suc 0] >> 6) && mask 26, capIsDevice_CL = (cap_C.words_C x1.[Suc 0] >> 5) && 1, capBlockSize_CL = cap_C.words_C x1.[Suc 0] && mask 5, capPtr_CL = cap_C.words_C x1.[0] && ~~ mask 4\<rparr>, cteMDBNode_CL = mdb_node_lift x2b\<rparr>); cslift x (cte_Ptr srcSlot) = Some (cte_C x1 x2b); cap_untyped_cap \<noteq> cap_null_cap; (if cap_C.words_C x1.[0] && 0xE \<noteq> 0xE then cap_C.words_C x1.[0] && mask 4 else cap_C.words_C x1.[0] && mask 8) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; d = to_bool ((cap_C.words_C x1.[Suc 0] >> 5) && 1); p = cap_C.words_C x1.[0] && ~~ mask 4; sz = unat (cap_C.words_C x1.[Suc 0] && mask 5)\<rbrakk> \<Longrightarrow> to_bool ((cap_C.words_C x1.[Suc 0] >> 5) && 1) = to_bool ((cap_C.words_C x1.[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0 >> 5) && 1) \<and> cap_C.words_C x1.[Suc 0] && mask 5 = (cap_C.words_C x1.[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0) && mask 5 \<and> i' = unat ((cap_C.words_C x1.[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0 >> 6) && mask 26 << 4)
 2. \<And>\<sigma> x i cte' y s'. \<lbrakk>ctes_of \<sigma> srcSlot = Some (cte_to_H y); cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cmachine_state_relation (ksMachineState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 3. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x s' x1 x2b. to_bool ((cap_C.words_C x1.[Suc 0] >> 5) && 1) = to_bool ((cap_C.words_C x1.[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0 >> 5) && 1) \<and> cap_C.words_C x1.[Suc 0] && mask 5 = (cap_C.words_C x1.[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0) && mask 5 \<and> i' = unat ((cap_C.words_C x1.[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0 >> 6) && mask 26 << 4)
 2. \<And>\<sigma> x i cte' y s'. \<lbrakk>ctes_of \<sigma> srcSlot = Some (cte_to_H y); cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cmachine_state_relation (ksMachineState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 3. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>x1. i' = unat ((cap_C.words_C x1.[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0 >> 6) && 0x3FFFFFF << 4)
 2. \<And>\<sigma> x i cte' y s'. \<lbrakk>ctes_of \<sigma> srcSlot = Some (cte_to_H y); cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cmachine_state_relation (ksMachineState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 3. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>x1. word_of_nat i' = (cap_C.words_C x1.[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0 >> 6) && 0x3FFFFFF << 4
 2. \<And>x1. i' \<in> unats LENGTH(32)
 3. \<And>x1. unat ((cap_C.words_C x1.[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0 >> 6) && 0x3FFFFFF << 4) \<in> unats LENGTH(32)
 4. \<And>\<sigma> x i cte' y s'. \<lbrakk>ctes_of \<sigma> srcSlot = Some (cte_to_H y); cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cmachine_state_relation (ksMachineState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 5. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>x1. \<lbrakk>is_aligned (word_of_nat i') minUntypedSizeBits; word_of_nat i' \<le> 2 ^ maxUntypedSizeBits\<rbrakk> \<Longrightarrow> word_of_nat i' = (cap_C.words_C x1.[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0 >> 6) && 0x3FFFFFF << 4
 2. \<And>x1. i' \<in> unats LENGTH(32)
 3. \<And>x1. unat ((cap_C.words_C x1.[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0 >> 6) && 0x3FFFFFF << 4) \<in> unats LENGTH(32)
 4. \<And>\<sigma> x i cte' y s'. \<lbrakk>ctes_of \<sigma> srcSlot = Some (cte_to_H y); cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cmachine_state_relation (ksMachineState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 5. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>x1. \<lbrakk>word_of_nat i' && mask minUntypedSizeBits = 0; word_of_nat i' \<le> 2 ^ maxUntypedSizeBits\<rbrakk> \<Longrightarrow> word_of_nat i' = (cap_C.words_C x1.[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0 >> 6) && 0x3FFFFFF << 4
 2. \<And>x1. i' \<in> unats LENGTH(32)
 3. \<And>x1. unat ((cap_C.words_C x1.[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0 >> 6) && 0x3FFFFFF << 4) \<in> unats LENGTH(32)
 4. \<And>\<sigma> x i cte' y s'. \<lbrakk>ctes_of \<sigma> srcSlot = Some (cte_to_H y); cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cmachine_state_relation (ksMachineState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 5. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<lbrakk>(word_of_nat i' !! 0 \<longrightarrow> \<not> mask minUntypedSizeBits !! 0) \<and> (word_of_nat i' !! 1 \<longrightarrow> \<not> mask minUntypedSizeBits !! 1) \<and> (word_of_nat i' !! 2 \<longrightarrow> \<not> mask minUntypedSizeBits !! 2) \<and> (word_of_nat i' !! 3 \<longrightarrow> \<not> mask minUntypedSizeBits !! 3) \<and> (word_of_nat i' !! 4 \<longrightarrow> \<not> mask minUntypedSizeBits !! 4) \<and> (word_of_nat i' !! 5 \<longrightarrow> \<not> mask minUntypedSizeBits !! 5) \<and> (word_of_nat i' !! 6 \<longrightarrow> \<not> mask minUntypedSizeBits !! 6) \<and> (word_of_nat i' !! 7 \<longrightarrow> \<not> mask minUntypedSizeBits !! 7) \<and> (word_of_nat i' !! 8 \<longrightarrow> \<not> mask minUntypedSizeBits !! 8) \<and> (word_of_nat i' !! 9 \<longrightarrow> \<not> mask minUntypedSizeBits !! 9) \<and> (word_of_nat i' !! 10 \<longrightarrow> \<not> mask minUntypedSizeBits !! 10) \<and> (word_of_nat i' !! 11 \<longrightarrow> \<not> mask minUntypedSizeBits !! 11) \<and> (word_of_nat i' !! 12 \<longrightarrow> \<not> mask minUntypedSizeBits !! 12) \<and> (word_of_nat i' !! 13 \<longrightarrow> \<not> mask minUntypedSizeBits !! 13) \<and> (word_of_nat i' !! 14 \<longrightarrow> \<not> mask minUntypedSizeBits !! 14) \<and> (word_of_nat i' !! 15 \<longrightarrow> \<not> mask minUntypedSizeBits !! 15) \<and> (word_of_nat i' !! 16 \<longrightarrow> \<not> mask minUntypedSizeBits !! 16) \<and> (word_of_nat i' !! 17 \<longrightarrow> \<not> mask minUntypedSizeBits !! 17) \<and> (word_of_nat i' !! 18 \<longrightarrow> \<not> mask minUntypedSizeBits !! 18) \<and> (word_of_nat i' !! 19 \<longrightarrow> \<not> mask minUntypedSizeBits !! 19) \<and> (word_of_nat i' !! 20 \<longrightarrow> \<not> mask minUntypedSizeBits !! 20) \<and> (word_of_nat i' !! 21 \<longrightarrow> \<not> mask minUntypedSizeBits !! 21) \<and> (word_of_nat i' !! 22 \<longrightarrow> \<not> mask minUntypedSizeBits !! 22) \<and> (word_of_nat i' !! 23 \<longrightarrow> \<not> mask minUntypedSizeBits !! 23) \<and> (word_of_nat i' !! 24 \<longrightarrow> \<not> mask minUntypedSizeBits !! 24) \<and> (word_of_nat i' !! 25 \<longrightarrow> \<not> mask minUntypedSizeBits !! 25) \<and> (word_of_nat i' !! 26 \<longrightarrow> \<not> mask minUntypedSizeBits !! 26) \<and> (word_of_nat i' !! 27 \<longrightarrow> \<not> mask minUntypedSizeBits !! 27) \<and> (word_of_nat i' !! 28 \<longrightarrow> \<not> mask minUntypedSizeBits !! 28) \<and> (word_of_nat i' !! 29 \<longrightarrow> \<not> mask minUntypedSizeBits !! 29) \<and> (word_of_nat i' !! 30 \<longrightarrow> \<not> mask minUntypedSizeBits !! 30) \<and> (word_of_nat i' !! 31 \<longrightarrow> \<not> mask minUntypedSizeBits !! 31); (2 ^ maxUntypedSizeBits) !! 31 \<and> \<not> word_of_nat i' !! 31 \<or> ((2 ^ maxUntypedSizeBits) !! 31 \<or> \<not> word_of_nat i' !! 31) \<and> ((2 ^ maxUntypedSizeBits) !! 30 \<and> \<not> word_of_nat i' !! 30 \<or> ((2 ^ maxUntypedSizeBits) !! 30 \<or> \<not> word_of_nat i' !! 30) \<and> ((2 ^ maxUntypedSizeBits) !! 29 \<and> \<not> word_of_nat i' !! 29 \<or> ((2 ^ maxUntypedSizeBits) !! 29 \<or> \<not> word_of_nat i' !! 29) \<and> ((2 ^ maxUntypedSizeBits) !! 28 \<and> \<not> word_of_nat i' !! 28 \<or> ((2 ^ maxUntypedSizeBits) !! 28 \<or> \<not> word_of_nat i' !! 28) \<and> ((2 ^ maxUntypedSizeBits) !! 27 \<and> \<not> word_of_nat i' !! 27 \<or> ((2 ^ maxUntypedSizeBits) !! 27 \<or> \<not> word_of_nat i' !! 27) \<and> ((2 ^ maxUntypedSizeBits) !! 26 \<and> \<not> word_of_nat i' !! 26 \<or> ((2 ^ maxUntypedSizeBits) !! 26 \<or> \<not> word_of_nat i' !! 26) \<and> ((2 ^ maxUntypedSizeBits) !! 25 \<and> \<not> word_of_nat i' !! 25 \<or> ((2 ^ maxUntypedSizeBits) !! 25 \<or> \<not> word_of_nat i' !! 25) \<and> ((2 ^ maxUntypedSizeBits) !! 24 \<and> \<not> word_of_nat i' !! 24 \<or> ((2 ^ maxUntypedSizeBits) !! 24 \<or> \<not> word_of_nat i' !! 24) \<and> ((2 ^ maxUntypedSizeBits) !! 23 \<and> \<not> word_of_nat i' !! 23 \<or> ((2 ^ maxUntypedSizeBits) !! 23 \<or> \<not> word_of_nat i' !! 23) \<and> ((2 ^ maxUntypedSizeBits) !! 22 \<and> \<not> word_of_nat i' !! 22 \<or> ((2 ^ maxUntypedSizeBits) !! 22 \<or> \<not> word_of_nat i' !! 22) \<and> ((2 ^ maxUntypedSizeBits) !! 21 \<and> \<not> word_of_nat i' !! 21 \<or> ((2 ^ maxUntypedSizeBits) !! 21 \<or> \<not> word_of_nat i' !! 21) \<and> ((2 ^ maxUntypedSizeBits) !! 20 \<and> \<not> word_of_nat i' !! 20 \<or> ((2 ^ maxUntypedSizeBits) !! 20 \<or> \<not> word_of_nat i' !! 20) \<and> ((2 ^ maxUntypedSizeBits) !! 19 \<and> \<not> word_of_nat i' !! 19 \<or> ((2 ^ maxUntypedSizeBits) !! 19 \<or> \<not> word_of_nat i' !! 19) \<and> ((2 ^ maxUntypedSizeBits) !! 18 \<and> \<not> word_of_nat i' !! 18 \<or> ((2 ^ maxUntypedSizeBits) !! 18 \<or> \<not> word_of_nat i' !! 18) \<and> ((2 ^ maxUntypedSizeBits) !! 17 \<and> \<not> word_of_nat i' !! 17 \<or> ((2 ^ maxUntypedSizeBits) !! 17 \<or> \<not> word_of_nat i' !! 17) \<and> ((2 ^ maxUntypedSizeBits) !! 16 \<and> \<not> word_of_nat i' !! 16 \<or> ((2 ^ maxUntypedSizeBits) !! 16 \<or> \<not> word_of_nat i' !! 16) \<and> ((2 ^ maxUntypedSizeBits) !! 15 \<and> \<not> word_of_nat i' !! 15 \<or> ((2 ^ maxUntypedSizeBits) !! 15 \<or> \<not> word_of_nat i' !! 15) \<and> ((2 ^ maxUntypedSizeBits) !! 14 \<and> \<not> word_of_nat i' !! 14 \<or> ((2 ^ maxUntypedSizeBits) !! 14 \<or> \<not> word_of_nat i' !! 14) \<and> ((2 ^ maxUntypedSizeBits) !! 13 \<and> \<not> word_of_nat i' !! 13 \<or> ((2 ^ maxUntypedSizeBits) !! 13 \<or> \<not> word_of_nat i' !! 13) \<and> ((2 ^ maxUntypedSizeBits) !! 12 \<and> \<not> word_of_nat i' !! 12 \<or> ((2 ^ maxUntypedSizeBits) !! 12 \<or> \<not> word_of_nat i' !! 12) \<and> ((2 ^ maxUntypedSizeBits) !! 11 \<and> \<not> word_of_nat i' !! 11 \<or> ((2 ^ maxUntypedSizeBits) !! 11 \<or> \<not> word_of_nat i' !! 11) \<and> ((2 ^ maxUntypedSizeBits) !! 10 \<and> \<not> word_of_nat i' !! 10 \<or> ((2 ^ maxUntypedSizeBits) !! 10 \<or> \<not> word_of_nat i' !! 10) \<and> ((2 ^ maxUntypedSizeBits) !! 9 \<and> \<not> word_of_nat i' !! 9 \<or> ((2 ^ maxUntypedSizeBits) !! 9 \<or> \<not> word_of_nat i' !! 9) \<and> ((2 ^ maxUntypedSizeBits) !! 8 \<and> \<not> word_of_nat i' !! 8 \<or> ((2 ^ maxUntypedSizeBits) !! 8 \<or> \<not> word_of_nat i' !! 8) \<and> ((2 ^ maxUntypedSizeBits) !! 7 \<and> \<not> word_of_nat i' !! 7 \<or> ((2 ^ maxUntypedSizeBits) !! 7 \<or> \<not> word_of_nat i' !! 7) \<and> ((2 ^ maxUntypedSizeBits) !! 6 \<and> \<not> word_of_nat i' !! 6 \<or> ((2 ^ maxUntypedSizeBits) !! 6 \<or> \<not> word_of_nat i' !! 6) \<and> ((2 ^ maxUntypedSizeBits) !! 5 \<and> \<not> word_of_nat i' !! 5 \<or> ((2 ^ maxUntypedSizeBits) !! 5 \<or> \<not> word_of_nat i' !! 5) \<and> ((2 ^ maxUntypedSizeBits) !! 4 \<and> \<not> word_of_nat i' !! 4 \<or> ((2 ^ maxUntypedSizeBits) !! 4 \<or> \<not> word_of_nat i' !! 4) \<and> ((2 ^ maxUntypedSizeBits) !! 3 \<and> \<not> word_of_nat i' !! 3 \<or> ((2 ^ maxUntypedSizeBits) !! 3 \<or> \<not> word_of_nat i' !! 3) \<and> ((2 ^ maxUntypedSizeBits) !! 2 \<and> \<not> word_of_nat i' !! 2 \<or> ((2 ^ maxUntypedSizeBits) !! 2 \<or> \<not> word_of_nat i' !! 2) \<and> ((2 ^ maxUntypedSizeBits) !! 1 \<and> \<not> word_of_nat i' !! 1 \<or> ((2 ^ maxUntypedSizeBits) !! 1 \<or> \<not> word_of_nat i' !! 1) \<and> ((2 ^ maxUntypedSizeBits) !! 0 \<and> \<not> word_of_nat i' !! 0 \<or> (2 ^ maxUntypedSizeBits) !! 0 \<or> \<not> word_of_nat i' !! 0)))))))))))))))))))))))))))))))\<rbrakk> \<Longrightarrow> \<not> word_of_nat i' !! 0 \<and> \<not> word_of_nat i' !! 1 \<and> \<not> word_of_nat i' !! 2 \<and> \<not> word_of_nat i' !! 3 \<and> [word_of_nat i' !! 4, word_of_nat i' !! 5, word_of_nat i' !! 6, word_of_nat i' !! 7, word_of_nat i' !! 8, word_of_nat i' !! 9, word_of_nat i' !! 10, word_of_nat i' !! 11, word_of_nat i' !! 12, word_of_nat i' !! 13, word_of_nat i' !! 14, word_of_nat i' !! 15, word_of_nat i' !! 16, word_of_nat i' !! 17, word_of_nat i' !! 18, word_of_nat i' !! 19, word_of_nat i' !! 20, word_of_nat i' !! 21, word_of_nat i' !! 22, word_of_nat i' !! 23, word_of_nat i' !! 24, word_of_nat i' !! 25, word_of_nat i' !! 26, word_of_nat i' !! 27, word_of_nat i' !! 28, word_of_nat i' !! 29, word_of_nat i' !! 30, word_of_nat i' !! 31] = takefill False (Suc (Suc (Suc (Suc 24)))) (map2 (\<and>) (takefill False (Suc (Suc (Suc (Suc 28)))) (map2 (\<or>) [False, False, False, False, False, False, False, False, False, False, False, False, False, False, False, False, False, False, False, False, False, False, False, False, False, False] (map2 (\<and>) (takefill False (Suc (Suc 24)) (takefill False (Suc (Suc (Suc (Suc 28)))) (drop minUntypedSizeBits [word_of_nat i' !! 0, word_of_nat i' !! 1, word_of_nat i' !! 2, word_of_nat i' !! 3, word_of_nat i' !! 4, word_of_nat i' !! 5, word_of_nat i' !! 6, word_of_nat i' !! 7, word_of_nat i' !! 8, word_of_nat i' !! 9, word_of_nat i' !! 10, word_of_nat i' !! 11, word_of_nat i' !! 12, word_of_nat i' !! 13, word_of_nat i' !! 14, word_of_nat i' !! 15, word_of_nat i' !! 16, word_of_nat i' !! 17, word_of_nat i' !! 18, word_of_nat i' !! 19, word_of_nat i' !! 20, word_of_nat i' !! 21, word_of_nat i' !! 22, word_of_nat i' !! 23, word_of_nat i' !! 24, word_of_nat i' !! 25, word_of_nat i' !! 26, word_of_nat i' !! 27, word_of_nat i' !! 28, word_of_nat i' !! 29, word_of_nat i' !! 30, word_of_nat i' !! 31]))) [True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True]))) [True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, False, False, False, False, False, False])
 2. \<And>x1. i' \<in> unats LENGTH(32)
 3. \<And>x1. unat ((cap_C.words_C x1.[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0 >> 6) && 0x3FFFFFF << 4) \<in> unats LENGTH(32)
 4. \<And>\<sigma> x i cte' y s'. \<lbrakk>ctes_of \<sigma> srcSlot = Some (cte_to_H y); cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cmachine_state_relation (ksMachineState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 5. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(word_of_nat i' !! 0 \<longrightarrow> \<not> mask minUntypedSizeBits !! 0) \<and> (word_of_nat i' !! 1 \<longrightarrow> \<not> mask minUntypedSizeBits !! 1) \<and> (word_of_nat i' !! 2 \<longrightarrow> \<not> mask minUntypedSizeBits !! 2) \<and> (word_of_nat i' !! 3 \<longrightarrow> \<not> mask minUntypedSizeBits !! 3) \<and> (word_of_nat i' !! 4 \<longrightarrow> \<not> mask minUntypedSizeBits !! 4) \<and> (word_of_nat i' !! 5 \<longrightarrow> \<not> mask minUntypedSizeBits !! 5) \<and> (word_of_nat i' !! 6 \<longrightarrow> \<not> mask minUntypedSizeBits !! 6) \<and> (word_of_nat i' !! 7 \<longrightarrow> \<not> mask minUntypedSizeBits !! 7) \<and> (word_of_nat i' !! 8 \<longrightarrow> \<not> mask minUntypedSizeBits !! 8) \<and> (word_of_nat i' !! 9 \<longrightarrow> \<not> mask minUntypedSizeBits !! 9) \<and> (word_of_nat i' !! 10 \<longrightarrow> \<not> mask minUntypedSizeBits !! 10) \<and> (word_of_nat i' !! 11 \<longrightarrow> \<not> mask minUntypedSizeBits !! 11) \<and> (word_of_nat i' !! 12 \<longrightarrow> \<not> mask minUntypedSizeBits !! 12) \<and> (word_of_nat i' !! 13 \<longrightarrow> \<not> mask minUntypedSizeBits !! 13) \<and> (word_of_nat i' !! 14 \<longrightarrow> \<not> mask minUntypedSizeBits !! 14) \<and> (word_of_nat i' !! 15 \<longrightarrow> \<not> mask minUntypedSizeBits !! 15) \<and> (word_of_nat i' !! 16 \<longrightarrow> \<not> mask minUntypedSizeBits !! 16) \<and> (word_of_nat i' !! 17 \<longrightarrow> \<not> mask minUntypedSizeBits !! 17) \<and> (word_of_nat i' !! 18 \<longrightarrow> \<not> mask minUntypedSizeBits !! 18) \<and> (word_of_nat i' !! 19 \<longrightarrow> \<not> mask minUntypedSizeBits !! 19) \<and> (word_of_nat i' !! 20 \<longrightarrow> \<not> mask minUntypedSizeBits !! 20) \<and> (word_of_nat i' !! 21 \<longrightarrow> \<not> mask minUntypedSizeBits !! 21) \<and> (word_of_nat i' !! 22 \<longrightarrow> \<not> mask minUntypedSizeBits !! 22) \<and> (word_of_nat i' !! 23 \<longrightarrow> \<not> mask minUntypedSizeBits !! 23) \<and> (word_of_nat i' !! 24 \<longrightarrow> \<not> mask minUntypedSizeBits !! 24) \<and> (word_of_nat i' !! 25 \<longrightarrow> \<not> mask minUntypedSizeBits !! 25) \<and> (word_of_nat i' !! 26 \<longrightarrow> \<not> mask minUntypedSizeBits !! 26) \<and> (word_of_nat i' !! 27 \<longrightarrow> \<not> mask minUntypedSizeBits !! 27) \<and> (word_of_nat i' !! 28 \<longrightarrow> \<not> mask minUntypedSizeBits !! 28) \<and> (word_of_nat i' !! 29 \<longrightarrow> \<not> mask minUntypedSizeBits !! 29) \<and> (word_of_nat i' !! 30 \<longrightarrow> \<not> mask minUntypedSizeBits !! 30) \<and> (word_of_nat i' !! 31 \<longrightarrow> \<not> mask minUntypedSizeBits !! 31); (2 ^ maxUntypedSizeBits) !! 31 \<and> \<not> word_of_nat i' !! 31 \<or> ((2 ^ maxUntypedSizeBits) !! 31 \<or> \<not> word_of_nat i' !! 31) \<and> ((2 ^ maxUntypedSizeBits) !! 30 \<and> \<not> word_of_nat i' !! 30 \<or> ((2 ^ maxUntypedSizeBits) !! 30 \<or> \<not> word_of_nat i' !! 30) \<and> ((2 ^ maxUntypedSizeBits) !! 29 \<and> \<not> word_of_nat i' !! 29 \<or> ((2 ^ maxUntypedSizeBits) !! 29 \<or> \<not> word_of_nat i' !! 29) \<and> ((2 ^ maxUntypedSizeBits) !! 28 \<and> \<not> word_of_nat i' !! 28 \<or> ((2 ^ maxUntypedSizeBits) !! 28 \<or> \<not> word_of_nat i' !! 28) \<and> ((2 ^ maxUntypedSizeBits) !! 27 \<and> \<not> word_of_nat i' !! 27 \<or> ((2 ^ maxUntypedSizeBits) !! 27 \<or> \<not> word_of_nat i' !! 27) \<and> ((2 ^ maxUntypedSizeBits) !! 26 \<and> \<not> word_of_nat i' !! 26 \<or> ((2 ^ maxUntypedSizeBits) !! 26 \<or> \<not> word_of_nat i' !! 26) \<and> ((2 ^ maxUntypedSizeBits) !! 25 \<and> \<not> word_of_nat i' !! 25 \<or> ((2 ^ maxUntypedSizeBits) !! 25 \<or> \<not> word_of_nat i' !! 25) \<and> ((2 ^ maxUntypedSizeBits) !! 24 \<and> \<not> word_of_nat i' !! 24 \<or> ((2 ^ maxUntypedSizeBits) !! 24 \<or> \<not> word_of_nat i' !! 24) \<and> ((2 ^ maxUntypedSizeBits) !! 23 \<and> \<not> word_of_nat i' !! 23 \<or> ((2 ^ maxUntypedSizeBits) !! 23 \<or> \<not> word_of_nat i' !! 23) \<and> ((2 ^ maxUntypedSizeBits) !! 22 \<and> \<not> word_of_nat i' !! 22 \<or> ((2 ^ maxUntypedSizeBits) !! 22 \<or> \<not> word_of_nat i' !! 22) \<and> ((2 ^ maxUntypedSizeBits) !! 21 \<and> \<not> word_of_nat i' !! 21 \<or> ((2 ^ maxUntypedSizeBits) !! 21 \<or> \<not> word_of_nat i' !! 21) \<and> ((2 ^ maxUntypedSizeBits) !! 20 \<and> \<not> word_of_nat i' !! 20 \<or> ((2 ^ maxUntypedSizeBits) !! 20 \<or> \<not> word_of_nat i' !! 20) \<and> ((2 ^ maxUntypedSizeBits) !! 19 \<and> \<not> word_of_nat i' !! 19 \<or> ((2 ^ maxUntypedSizeBits) !! 19 \<or> \<not> word_of_nat i' !! 19) \<and> ((2 ^ maxUntypedSizeBits) !! 18 \<and> \<not> word_of_nat i' !! 18 \<or> ((2 ^ maxUntypedSizeBits) !! 18 \<or> \<not> word_of_nat i' !! 18) \<and> ((2 ^ maxUntypedSizeBits) !! 17 \<and> \<not> word_of_nat i' !! 17 \<or> ((2 ^ maxUntypedSizeBits) !! 17 \<or> \<not> word_of_nat i' !! 17) \<and> ((2 ^ maxUntypedSizeBits) !! 16 \<and> \<not> word_of_nat i' !! 16 \<or> ((2 ^ maxUntypedSizeBits) !! 16 \<or> \<not> word_of_nat i' !! 16) \<and> ((2 ^ maxUntypedSizeBits) !! 15 \<and> \<not> word_of_nat i' !! 15 \<or> ((2 ^ maxUntypedSizeBits) !! 15 \<or> \<not> word_of_nat i' !! 15) \<and> ((2 ^ maxUntypedSizeBits) !! 14 \<and> \<not> word_of_nat i' !! 14 \<or> ((2 ^ maxUntypedSizeBits) !! 14 \<or> \<not> word_of_nat i' !! 14) \<and> ((2 ^ maxUntypedSizeBits) !! 13 \<and> \<not> word_of_nat i' !! 13 \<or> ((2 ^ maxUntypedSizeBits) !! 13 \<or> \<not> word_of_nat i' !! 13) \<and> ((2 ^ maxUntypedSizeBits) !! 12 \<and> \<not> word_of_nat i' !! 12 \<or> ((2 ^ maxUntypedSizeBits) !! 12 \<or> \<not> word_of_nat i' !! 12) \<and> ((2 ^ maxUntypedSizeBits) !! 11 \<and> \<not> word_of_nat i' !! 11 \<or> ((2 ^ maxUntypedSizeBits) !! 11 \<or> \<not> word_of_nat i' !! 11) \<and> ((2 ^ maxUntypedSizeBits) !! 10 \<and> \<not> word_of_nat i' !! 10 \<or> ((2 ^ maxUntypedSizeBits) !! 10 \<or> \<not> word_of_nat i' !! 10) \<and> ((2 ^ maxUntypedSizeBits) !! 9 \<and> \<not> word_of_nat i' !! 9 \<or> ((2 ^ maxUntypedSizeBits) !! 9 \<or> \<not> word_of_nat i' !! 9) \<and> ((2 ^ maxUntypedSizeBits) !! 8 \<and> \<not> word_of_nat i' !! 8 \<or> ((2 ^ maxUntypedSizeBits) !! 8 \<or> \<not> word_of_nat i' !! 8) \<and> ((2 ^ maxUntypedSizeBits) !! 7 \<and> \<not> word_of_nat i' !! 7 \<or> ((2 ^ maxUntypedSizeBits) !! 7 \<or> \<not> word_of_nat i' !! 7) \<and> ((2 ^ maxUntypedSizeBits) !! 6 \<and> \<not> word_of_nat i' !! 6 \<or> ((2 ^ maxUntypedSizeBits) !! 6 \<or> \<not> word_of_nat i' !! 6) \<and> ((2 ^ maxUntypedSizeBits) !! 5 \<and> \<not> word_of_nat i' !! 5 \<or> ((2 ^ maxUntypedSizeBits) !! 5 \<or> \<not> word_of_nat i' !! 5) \<and> ((2 ^ maxUntypedSizeBits) !! 4 \<and> \<not> word_of_nat i' !! 4 \<or> ((2 ^ maxUntypedSizeBits) !! 4 \<or> \<not> word_of_nat i' !! 4) \<and> ((2 ^ maxUntypedSizeBits) !! 3 \<and> \<not> word_of_nat i' !! 3 \<or> ((2 ^ maxUntypedSizeBits) !! 3 \<or> \<not> word_of_nat i' !! 3) \<and> ((2 ^ maxUntypedSizeBits) !! 2 \<and> \<not> word_of_nat i' !! 2 \<or> ((2 ^ maxUntypedSizeBits) !! 2 \<or> \<not> word_of_nat i' !! 2) \<and> ((2 ^ maxUntypedSizeBits) !! 1 \<and> \<not> word_of_nat i' !! 1 \<or> ((2 ^ maxUntypedSizeBits) !! 1 \<or> \<not> word_of_nat i' !! 1) \<and> ((2 ^ maxUntypedSizeBits) !! 0 \<and> \<not> word_of_nat i' !! 0 \<or> (2 ^ maxUntypedSizeBits) !! 0 \<or> \<not> word_of_nat i' !! 0)))))))))))))))))))))))))))))))\<rbrakk> \<Longrightarrow> \<not> word_of_nat i' !! 0 \<and> \<not> word_of_nat i' !! 1 \<and> \<not> word_of_nat i' !! 2 \<and> \<not> word_of_nat i' !! 3 \<and> [word_of_nat i' !! 4, word_of_nat i' !! 5, word_of_nat i' !! 6, word_of_nat i' !! 7, word_of_nat i' !! 8, word_of_nat i' !! 9, word_of_nat i' !! 10, word_of_nat i' !! 11, word_of_nat i' !! 12, word_of_nat i' !! 13, word_of_nat i' !! 14, word_of_nat i' !! 15, word_of_nat i' !! 16, word_of_nat i' !! 17, word_of_nat i' !! 18, word_of_nat i' !! 19, word_of_nat i' !! 20, word_of_nat i' !! 21, word_of_nat i' !! 22, word_of_nat i' !! 23, word_of_nat i' !! 24, word_of_nat i' !! 25, word_of_nat i' !! 26, word_of_nat i' !! 27, word_of_nat i' !! 28, word_of_nat i' !! 29, word_of_nat i' !! 30, word_of_nat i' !! 31] = takefill False (Suc (Suc (Suc (Suc 24)))) (map2 (\<and>) (takefill False (Suc (Suc (Suc (Suc 28)))) (map2 (\<or>) [False, False, False, False, False, False, False, False, False, False, False, False, False, False, False, False, False, False, False, False, False, False, False, False, False, False] (map2 (\<and>) (takefill False (Suc (Suc 24)) (takefill False (Suc (Suc (Suc (Suc 28)))) (drop minUntypedSizeBits [word_of_nat i' !! 0, word_of_nat i' !! 1, word_of_nat i' !! 2, word_of_nat i' !! 3, word_of_nat i' !! 4, word_of_nat i' !! 5, word_of_nat i' !! 6, word_of_nat i' !! 7, word_of_nat i' !! 8, word_of_nat i' !! 9, word_of_nat i' !! 10, word_of_nat i' !! 11, word_of_nat i' !! 12, word_of_nat i' !! 13, word_of_nat i' !! 14, word_of_nat i' !! 15, word_of_nat i' !! 16, word_of_nat i' !! 17, word_of_nat i' !! 18, word_of_nat i' !! 19, word_of_nat i' !! 20, word_of_nat i' !! 21, word_of_nat i' !! 22, word_of_nat i' !! 23, word_of_nat i' !! 24, word_of_nat i' !! 25, word_of_nat i' !! 26, word_of_nat i' !! 27, word_of_nat i' !! 28, word_of_nat i' !! 29, word_of_nat i' !! 30, word_of_nat i' !! 31]))) [True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True]))) [True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, True, False, False, False, False, False, False]) proof (prove)
goal (4 subgoals):
 1. \<And>x1. i' \<in> unats LENGTH(32)
 2. \<And>x1. unat ((cap_C.words_C x1.[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0 >> 6) && 0x3FFFFFF << 4) \<in> unats LENGTH(32)
 3. \<And>\<sigma> x i cte' y s'. \<lbrakk>ctes_of \<sigma> srcSlot = Some (cte_to_H y); cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cmachine_state_relation (ksMachineState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 4. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>x1. i' \<le> 536870912 \<Longrightarrow> i' \<in> unats LENGTH(32)
 2. \<And>x1. unat ((cap_C.words_C x1.[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0 >> 6) && 0x3FFFFFF << 4) \<in> unats LENGTH(32)
 3. \<And>\<sigma> x i cte' y s'. \<lbrakk>ctes_of \<sigma> srcSlot = Some (cte_to_H y); cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cmachine_state_relation (ksMachineState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 4. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. i' \<le> 536870912 \<Longrightarrow> i' \<in> unats LENGTH(32) proof (prove)
goal (3 subgoals):
 1. \<And>x1. unat ((cap_C.words_C x1.[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0 >> 6) && 0x3FFFFFF << 4) \<in> unats LENGTH(32)
 2. \<And>\<sigma> x i cte' y s'. \<lbrakk>ctes_of \<sigma> srcSlot = Some (cte_to_H y); cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cmachine_state_relation (ksMachineState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 3. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. unat ((cap_C.words_C x1_.[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0 >> 6) && 0x3FFFFFF << 4) \<in> unats LENGTH(32) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x i cte' y s'. \<lbrakk>ctes_of \<sigma> srcSlot = Some (cte_to_H y); cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cmachine_state_relation (ksMachineState s') (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 2. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x i cte' y s'. \<lbrakk>ctes_of \<sigma> srcSlot = Some (cte_to_H y); cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>))) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) (underlying_memory (ksMachineState (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) (underlying_memory (ksMachineState (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) \<and> zero_ranges_are_zero (gsUntypedZeroRanges (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) \<and> ksCurThread \<sigma> = ksCurThread (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>) \<and> ksIdleThread \<sigma> = ksIdleThread (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>) \<and> cinterrupt_relation (ksInterruptState (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cmachine_state_relation (ksMachineState (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cte_array_relation (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>) (globals x) \<and> gsUserPages \<sigma> = gsUserPages (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>) \<and> gsCNodes \<sigma> = gsCNodes (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>) \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>) \<and> cdom_schedule_relation (kernel_state.ksDomSchedule (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) \<and> ksCurDomain \<sigma> = ksCurDomain (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>) \<and> ksDomainTime \<sigma> = ksDomainTime (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)
 2. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x i cte' y s'. \<lbrakk>ctes_of \<sigma> srcSlot = Some (cte_to_H y); cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> carch_state_relation (ksArchState \<sigma>) (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cmachine_state_relation (ksMachineState \<sigma>) (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x))
 2. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x i cte' y s'. \<lbrakk>ctes_of \<sigma> srcSlot = Some (cte_to_H y); cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation
 2. \<And>\<sigma> x i cte' y s'. \<lbrakk>ctes_of \<sigma> srcSlot = Some (cte_to_H y); cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cmachine_state_relation (ksMachineState \<sigma>) (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x))
 3. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ctes_of \<sigma>_ srcSlot = Some (cte_to_H y_); cap_to_H (cap_CL y_) = capability.UntypedCap d p sz i_; cslift x_ (cte_Ptr srcSlot) = Some cte'_; cte_lift cte'_ = Some y_; c_valid_cte cte'_; ctes_of s'_ = (ctes_of \<sigma>_)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y_)); map_to_eps (ksPSpace \<sigma>_) = map_to_eps (ksPSpace s'_); map_to_ntfns (ksPSpace \<sigma>_) = map_to_ntfns (ksPSpace s'_); map_to_pdes (ksPSpace \<sigma>_) = map_to_pdes (ksPSpace s'_); map_to_ptes (ksPSpace \<sigma>_) = map_to_ptes (ksPSpace s'_); map_to_asidpools (ksPSpace \<sigma>_) = map_to_asidpools (ksPSpace s'_); map_to_user_data (ksPSpace \<sigma>_) = map_to_user_data (ksPSpace s'_); map_to_user_data_device (ksPSpace \<sigma>_) = map_to_user_data_device (ksPSpace s'_); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>_) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'_); \<forall>T p. typ_at' T p \<sigma>_ = typ_at' T p s'_; cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); carch_state_relation (ksArchState \<sigma>_) (globals x_); cmachine_state_relation (ksMachineState \<sigma>_) (globals x_); cte_array_relation \<sigma>_ (globals x_); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'_)) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x_))); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_; cmap_relation (ctes_of \<sigma>_) (cslift x_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s'_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace s'_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_pdes (ksPSpace s'_)) (cslift x_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s'_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s'_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s'_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s'_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s'_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s'_)) (c_h_t_valid x_) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s'_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x i cte' y s'. \<lbrakk>ctes_of \<sigma> srcSlot = Some (cte_to_H y); cap_to_H (cap_CL y) = capability.UntypedCap d p sz i; cslift x (cte_Ptr srcSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; ctes_of s' = (ctes_of \<sigma>)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s')) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x)) \<and> cmachine_state_relation (ksMachineState \<sigma>) (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte')) (Suc 0) (cap_C.words_C (cte_C.cap_C cte').[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x))
 2. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ctes_of \<sigma>_ srcSlot = Some (cte_to_H y_); cap_to_H (cap_CL y_) = capability.UntypedCap d p sz i_; cslift x_ (cte_Ptr srcSlot) = Some cte'_; cte_lift cte'_ = Some y_; c_valid_cte cte'_; ctes_of s'_ = (ctes_of \<sigma>_)(srcSlot \<mapsto> cteCap_update (\<lambda>_. capability.UntypedCap d p sz i') (cte_to_H y_)); map_to_eps (ksPSpace \<sigma>_) = map_to_eps (ksPSpace s'_); map_to_ntfns (ksPSpace \<sigma>_) = map_to_ntfns (ksPSpace s'_); map_to_pdes (ksPSpace \<sigma>_) = map_to_pdes (ksPSpace s'_); map_to_ptes (ksPSpace \<sigma>_) = map_to_ptes (ksPSpace s'_); map_to_asidpools (ksPSpace \<sigma>_) = map_to_asidpools (ksPSpace s'_); map_to_user_data (ksPSpace \<sigma>_) = map_to_user_data (ksPSpace s'_); map_to_user_data_device (ksPSpace \<sigma>_) = map_to_user_data_device (ksPSpace s'_); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>_) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'_); \<forall>T p. typ_at' T p \<sigma>_ = typ_at' T p s'_; cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); carch_state_relation (ksArchState \<sigma>_) (globals x_); cmachine_state_relation (ksMachineState \<sigma>_) (globals x_); cte_array_relation \<sigma>_ (globals x_); cvariable_array_map_relation (map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'_)) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x_))); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_; cmap_relation (ctes_of \<sigma>_) (cslift x_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s'_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace s'_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_pdes (ksPSpace s'_)) (cslift x_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s'_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s'_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s'_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s'_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s'_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s'_)) (c_h_t_valid x_) pt_Ptr\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>_) (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte'_)) (Suc 0) (cap_C.words_C (cte_C.cap_C cte'_).[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte'_)) (Suc 0) (cap_C.words_C (cte_C.cap_C cte'_).[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte'_)) (Suc 0) (cap_C.words_C (cte_C.cap_C cte'_).[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte'_)) (Suc 0) (cap_C.words_C (cte_C.cap_C cte'_).[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x_)) \<and> cmachine_state_relation (ksMachineState \<sigma>_) (t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte'_)) (Suc 0) (cap_C.words_C (cte_C.cap_C cte'_).[Suc 0] && 0x3F || (word_of_nat i' >> minUntypedSizeBits << 6) && 0xFFFFFFC0)) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte'_)) (Suc 0) (cap_C.words_C (cte_C.cap_C cte'_).[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte'_)) (Suc 0) (cap_C.words_C (cte_C.cap_C cte'_).[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (cte_Ptr srcSlot)))) (hrs_mem_update (heap_update (cte_Ptr srcSlot) (cte_C.cap_C_update (\<lambda>_. cap_C.words_C_update (\<lambda>_. Arrays.update (cap_C.words_C (cte_C.cap_C cte'_)) (Suc 0) (cap_C.words_C (cte_C.cap_C cte'_).[Suc 0] && 0x3F)) (h_val (hrs_mem x) (cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])))) (h_val (hrs_mem x) (cte_Ptr srcSlot)))) x)) (globals x_)) proof (prove)
goal (1 subgoal):
 1. \<And>v32 cap_ptr s s'. \<lbrakk>v32 = word_of_nat i' >> minUntypedSizeBits; cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C'']); (s, s') \<in> rf_sr; cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s srcSlot = Some cte \<longrightarrow> ctes_of s srcSlot = Some cte \<and> (\<exists>i. cteCap cte = capability.UntypedCap d p sz i)) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr srcSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV} proof (state)
this:
ccorres dc xfdc (cte_wp_at' (\<lambda>cte. \<exists>i. cteCap cte = capability.UntypedCap d p sz i) srcSlot) (UNIV \<inter> \<lbrace>\<acute>cap_ptr = cap_Ptr &(cte_Ptr srcSlot\<rightarrow>[''cap_C''])\<rbrace> \<inter> \<lbrace>\<acute>v32 = word_of_nat i' >> minUntypedSizeBits\<rbrace>) [] (updateCap srcSlot (capability.UntypedCap d p sz i')) (Call cap_untyped_cap_ptr_set_capFreeIndex_'proc)

goal:
No subgoals!