theory Example_Valid_StateH

lemma s0H_invs:
  assumes "1 \<le> maxDomain"
  notes pdeBits_def[simp] pteBits_def[simp] objBits_defs[simp]
  shows "invs' s0H_internal" using assms supply option.case_cong[cong] if_cong[cong] apply (clarsimp simp: invs'_def valid_state'_def s0H_valid_pspace') apply (rule conjI) apply (clarsimp simp: sch_act_wf_def s0H_internal_def ct_in_state'_def st_tcb_at'_def obj_at'_def projectKO_eq project_inject objBitsKO_def s0_ptrs_aligned Low_tcbH_def) apply (rule pspace_distinctD''[OF _ s0H_pspace_distinct', simplified s0H_internal_def]) apply (simp add: objBitsKO_def) apply (rule conjI) apply (clarsimp simp: valid_queues_def valid_queues_no_bitmap_def bitmapQ_defs s0H_internal_def) apply (rule conjI) apply (clarsimp simp: sym_refs_def state_refs_of'_def refs_of'_def split: option.splits) apply (frule kh0H_SomeD) apply (elim disjE, simp_all)[1] apply (clarsimp simp: tcb_st_refs_of'_def idle_tcbH_def) apply (clarsimp simp: tcb_st_refs_of'_def High_tcbH_def) apply (rule conjI) apply (clarsimp simp: ntfnH_def) apply (clarsimp simp: objBitsKO_def ntfnH_def) apply (erule impE, simp add: is_aligned_def s0_ptr_defs) apply (erule notE, rule pspace_distinctD''[OF _ s0H_pspace_distinct']) apply (simp add: objBitsKO_def ntfnH_def) apply (clarsimp simp: tcb_st_refs_of'_def Low_tcbH_def) apply (clarsimp simp: ntfnH_def ntfn_q_refs_of'_def) apply (rule conjI) apply (clarsimp simp: tcb_st_refs_of'_def High_tcbH_def) apply (clarsimp simp: objBitsKO_def s0_ptrs_aligned) apply (erule notE, rule pspace_distinctD''[OF _ s0H_pspace_distinct']) apply (simp add: objBitsKO_def) apply (clarsimp simp: irq_cte_def) apply (clarsimp simp: Low_cte_def Low_cte'_def split: if_split_asm) apply (clarsimp simp: High_cte_def High_cte'_def split: if_split_asm) apply (clarsimp simp: Silc_cte_def Silc_cte'_def split: if_split_asm) apply (clarsimp simp: global_pdH'_def) apply (clarsimp simp: High_pdH_def) apply (clarsimp simp: Low_pdH_def) apply (clarsimp simp: High_ptH_def) apply (clarsimp simp: Low_ptH_def) apply (rule conjI) apply (clarsimp simp: if_live_then_nonz_cap'_def ko_wp_at'_def) apply (drule kh0H_SomeD) apply (elim disjE, simp_all add: kh0H_all_obj_def' objBitsKO_def)[1] apply (clarsimp simp: ex_nonz_cap_to'_def cte_wp_at_ctes_of) apply (rule_tac x="High_cnode_ptr + 0x10" in exI) apply (clarsimp simp: kh0H_all_obj_def') apply (clarsimp simp: ex_nonz_cap_to'_def cte_wp_at_ctes_of) apply (rule_tac x="Low_cnode_ptr + 0x10" in exI) apply (clarsimp simp: kh0H_all_obj_def') apply (clarsimp simp: ex_nonz_cap_to'_def cte_wp_at_ctes_of) apply (rule_tac x="Silc_cnode_ptr + 0x13E0" in exI) apply (clarsimp simp: kh0H_all_obj_def') apply (clarsimp split: if_split_asm)+ apply (rule conjI) apply (clarsimp simp: if_unsafe_then_cap'_def ex_cte_cap_wp_to'_def cte_wp_at_ctes_of) apply (frule map_to_ctes_kh0H_SomeD) apply (elim disjE, simp_all add: kh0H_all_obj_def')[1] apply (rule_tac x="Low_cnode_ptr + 0x10" in exI) apply (clarsimp simp: kh0H_all_obj_def' image_def) apply (rule_tac x="Low_cnode_ptr + 0x10" in exI) apply (clarsimp simp: kh0H_all_obj_def' image_def) apply (rule_tac x="Low_cnode_ptr + 0x10" in exI) apply (clarsimp simp: kh0H_all_obj_def' image_def) apply (rule_tac x="High_cnode_ptr + 0x10" in exI) apply (clarsimp simp: kh0H_all_obj_def' image_def) apply (rule_tac x="High_cnode_ptr + 0x10" in exI) apply (clarsimp simp: kh0H_all_obj_def' image_def) apply (rule_tac x="High_cnode_ptr + 0x10" in exI) apply (clarsimp simp: kh0H_all_obj_def' image_def) apply (rule_tac x="Silc_cnode_ptr + 0x20" in exI) apply (clarsimp simp: kh0H_all_obj_def' image_def to_bl_use_of_bl cte_level_bits_def the_nat_to_bl_simps split: if_split_asm) apply (drule(2) ucast_shiftr_13E, rule s0_ptrs_aligned, simp) apply (rule_tac x="0x13E" in bexI) apply simp apply simp apply (drule(2) ucast_shiftr_2, rule s0_ptrs_aligned, simp) apply (rule_tac x=2 in bexI) apply simp apply simp apply (rule_tac x="High_cnode_ptr + 0x20" in exI) apply (clarsimp simp: kh0H_all_obj_def' image_def to_bl_use_of_bl cte_level_bits_def the_nat_to_bl_simps split: if_split_asm) apply (drule(2) ucast_shiftr_13E, rule s0_ptrs_aligned, simp) apply (rule_tac x="0x13E" in bexI) apply simp apply simp apply (drule(2) ucast_shiftr_3, rule s0_ptrs_aligned, simp) apply (rule_tac x=3 in bexI) apply simp apply simp apply (drule(2) ucast_shiftr_2, rule s0_ptrs_aligned, simp) apply (rule_tac x=2 in bexI) apply simp apply simp apply (drule(2) ucast_shiftr_1, rule s0_ptrs_aligned, simp) apply (rule_tac x=1 in bexI) apply simp apply simp apply (rule_tac x="Low_cnode_ptr + 0x20" in exI) apply (clarsimp simp: kh0H_all_obj_def' image_def to_bl_use_of_bl cte_level_bits_def the_nat_to_bl_simps split: if_split_asm) apply (drule(2) ucast_shiftr_13E, rule s0_ptrs_aligned, simp) apply (rule_tac x="0x13E" in bexI) apply simp apply simp apply (drule(2) ucast_shiftr_3, rule s0_ptrs_aligned, simp) apply (rule_tac x=3 in bexI) apply simp apply simp apply (drule(2) ucast_shiftr_2, rule s0_ptrs_aligned, simp) apply (rule_tac x=2 in bexI) apply simp apply simp apply (drule(2) ucast_shiftr_1, rule s0_ptrs_aligned, simp) apply (rule_tac x=1 in bexI) apply simp apply simp apply (rule conjI) apply (clarsimp simp: valid_idle'_def pred_tcb_at'_def obj_at'_def projectKO_eq project_inject
                         objBitsKO_def idle_tcb'_def) apply (clarsimp simp: s0H_internal_def s0_ptrs_aligned idle_tcbH_def) apply (rule conjI) apply (rule pspace_distinctD''[OF _ s0H_pspace_distinct', simplified s0H_internal_def]) apply (simp add: objBitsKO_def) apply (clarsimp simp: idle_tcb_ptr_def idle_thread_ptr_def) apply (rule conjI) apply (clarsimp simp: kdr_valid_global_refs')  (* use axiomatization for now *)
   apply (rule conjI) apply (clarsimp simp: valid_arch_state'_def) apply (intro conjI) apply (clarsimp simp: s0H_internal_def arch_state0H_def objBitsKO_def pageBits_def) apply (clarsimp simp: s0_ptr_defs is_aligned_def) apply (cut_tac s0H_pspace_distinct')[1] apply (simp add: s0H_internal_def arch_state0H_def) apply (clarsimp simp: valid_asid_table'_def s0H_internal_def arch_state0H_def) apply (clarsimp simp: page_directory_at'_def s0H_internal_def arch_state0H_def pdBits_def pageBits_def s0_ptrs_aligned) apply (clarsimp simp: typ_at'_def ko_wp_at'_def) apply (drule less_t2n_ex_ucast[where n=12 and 'b=12, simplified]) apply clarsimp apply (cut_tac x=ya in pd_offs_in_range(3)) apply (clarsimp simp: global_pdH'_def objBitsKO_def archObjSize_def pd_offs_range_def) apply (rule pspace_distinctD'') apply (simp add: objBitsKO_def archObjSize_def global_pdH'_def) apply (cut_tac s0H_pspace_distinct')[1] apply (simp add: s0H_internal_def arch_state0H_def) apply (clarsimp simp: valid_global_pts'_def s0H_internal_def arch_state0H_def) apply (clarsimp simp: is_inv_def s0H_internal_def arch_state0H_def) apply (clarsimp simp: valid_asid_map'_def s0H_internal_def arch_state0H_def) apply (rule conjI) apply (clarsimp simp: valid_irq_node'_def) apply (rule conjI) apply (clarsimp simp: s0H_internal_def is_aligned_def s0_ptr_defs word_size) apply (clarsimp simp: obj_at'_def projectKO_eq project_inject objBitsKO_def s0H_internal_def
                         shiftl_t2n[where n=4, simplified, symmetric]
                          kh0H_simps(1)[simplified cte_level_bits_def]) apply (rule conjI) apply (rule is_aligned_add) apply (simp add: is_aligned_def s0_ptr_defs) apply (rule is_aligned_shift) apply (rule pspace_distinctD''[OF _ s0H_pspace_distinct', simplified s0H_internal_def]) apply (simp add: objBitsKO_def kh0H_simps(1)[simplified cte_level_bits_def]) apply (rule conjI) apply (clarsimp simp: valid_irq_handlers'_def cteCaps_of_def ran_def) apply (drule_tac map_to_ctes_kh0H_SomeD) apply (elim disjE, simp_all add: kh0H_all_obj_def')[1] apply ((clarsimp split: if_split_asm)+)[3] apply (rule conjI) apply (clarsimp simp: valid_irq_states'_def s0H_internal_def machine_state0_def) apply (rule conjI) apply (clarsimp simp: valid_machine_state'_def s0H_internal_def machine_state0_def) apply (rule conjI) apply (clarsimp simp: irqs_masked'_def s0H_internal_def maxIRQ_def timer_irq_def) apply (rule conjI) apply (clarsimp simp: valid_queues'_def obj_at'_def projectKO_eq project_inject s0H_internal_def inQ_def) apply (frule kh0H_dom_tcb) apply (elim disjE, (clarsimp simp: kh0H_obj_def)+)[1] apply (rule conjI) apply (clarsimp simp: ct_not_inQ_def obj_at'_def projectKO_eq project_inject s0H_internal_def objBitsKO_def s0_ptrs_aligned Low_tcbH_def) apply (rule pspace_distinctD''[OF _ s0H_pspace_distinct', simplified s0H_internal_def]) apply (simp add: objBitsKO_def) 
(*   apply (simp add: objBitsKO_def kh0H_simps[simplified cte_level_bits_def])*)
   apply (rule conjI) apply (clarsimp simp: ct_idle_or_in_cur_domain'_def obj_at'_def projectKO_eq project_inject tcb_in_cur_domain'_def s0H_internal_def Low_tcbH_def Low_domain_def objBitsKO_def s0_ptrs_aligned) apply (rule pspace_distinctD''[OF _ s0H_pspace_distinct', simplified s0H_internal_def]) apply (simp add: objBitsKO_def) 
(*   apply (simp add: objBitsKO_def kh0H_simps[simplified cte_level_bits_def])*)
   apply (rule conjI) apply (clarsimp simp: valid_pde_mappings'_def obj_at'_def projectKO_eq project_inject) apply (drule kh0H_SomeD) apply (elim disjE, simp_all add: kh0H_all_obj_def High_pd'H_def Low_pd'H_def)[1] apply (clarsimp split: if_split_asm)+ apply (clarsimp simp: objBitsKO_def archObjSize_def valid_pde_mapping_offset'_def pd_asid_slot_def pdBits_def pageBits_def) apply (cut_tac x="x - init_global_pd >> 2" and n=12 and 'a=12 in ucast_mask_drop) apply simp apply (subst(asm) shiftr_then_mask_commute) apply simp apply (subst(asm) mask_eqs(4)[symmetric]) apply (subst(asm) is_aligned_mask[where w="init_global_pd", THEN iffD1]) apply (simp add: s0_ptrs_aligned) apply (simp add: kernel_base_def) apply (clarsimp simp: objBitsKO_def archObjSize_def valid_pde_mapping_offset'_def pd_asid_slot_def pdBits_def pageBits_def split: if_split_asm) apply (cut_tac x="x - High_pd_ptr >> 2" and n=12 and 'a=12 in ucast_mask_drop) apply simp apply (subst(asm) shiftr_then_mask_commute) apply simp apply (subst(asm) mask_eqs(4)[symmetric]) apply (subst(asm) is_aligned_mask[where w="High_pd_ptr", THEN iffD1]) apply (simp add: s0_ptrs_aligned) apply (simp add: kernel_base_def) apply (cut_tac x="x - High_pd_ptr >> 2" and n=12 and 'a=12 in ucast_mask_drop) apply simp apply (subst(asm) shiftr_then_mask_commute) apply simp apply (subst(asm) mask_eqs(4)[symmetric]) apply (subst(asm) is_aligned_mask[where w="High_pd_ptr", THEN iffD1]) apply (simp add: s0_ptrs_aligned) apply (simp add: kernel_base_def) apply (clarsimp simp: objBitsKO_def archObjSize_def valid_pde_mapping_offset'_def pd_asid_slot_def pdBits_def pageBits_def split: if_split_asm) apply (cut_tac x="x - Low_pd_ptr >> 2" and n=12 and 'a=12 in ucast_mask_drop) apply simp apply (subst(asm) shiftr_then_mask_commute) apply simp apply (subst(asm) mask_eqs(4)[symmetric]) apply (subst(asm) is_aligned_mask[where w="Low_pd_ptr", THEN iffD1]) apply (simp add: s0_ptrs_aligned) apply (simp add: kernel_base_def) apply (cut_tac x="x - Low_pd_ptr >> 2" and n=12 and 'a=12 in ucast_mask_drop) apply simp apply (subst(asm) shiftr_then_mask_commute) apply simp apply (subst(asm) mask_eqs(4)[symmetric]) apply (subst(asm) is_aligned_mask[where w="Low_pd_ptr", THEN iffD1]) apply (simp add: s0_ptrs_aligned) apply (simp add: kernel_base_def) apply (clarsimp split: if_split_asm) apply (clarsimp split: if_split_asm) apply (rule conjI) apply (clarsimp simp: kdr_pspace_domain_valid)  (* use axiomatization for now *)
  (* unfold s0H_internal for remaining goals *)
   apply (clarsimp simp: s0H_internal_def cteCaps_of_def
                        untyped_ranges_zero_inv_def
                        dschDomain_def dschLength_def) apply (clarsimp simp: newKernelState_def newKSDomSched) apply (clarsimp simp: cur_tcb'_def obj_at'_def projectKO_eq project_inject s0H_internal_def objBitsKO_def s0_ptrs_aligned) apply (rule pspace_distinctD''[OF _ s0H_pspace_distinct', simplified s0H_internal_def]) apply (simp add: objBitsKO_def) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. invs' s0H_internal proof (prove)
using this:
1 \<le> maxDomain

goal (1 subgoal):
 1. invs' s0H_internal proof (prove)
using this:
1 \<le> maxDomain

goal (1 subgoal):
 1. invs' s0H_internal proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> sch_act_wf (ksSchedulerAction s0H_internal) s0H_internal \<and> Invariants_H.valid_queues s0H_internal \<and> sym_refs (state_refs_of' s0H_internal) \<and> if_live_then_nonz_cap' s0H_internal \<and> if_unsafe_then_cap' s0H_internal \<and> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> sch_act_wf (ksSchedulerAction s0H_internal) s0H_internal
 2. 1 \<le> maxDomain \<Longrightarrow> Invariants_H.valid_queues s0H_internal \<and> sym_refs (state_refs_of' s0H_internal) \<and> if_live_then_nonz_cap' s0H_internal \<and> if_unsafe_then_cap' s0H_internal \<and> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> ps_clear Low_tcb_ptr 9 \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = init_globals_frame then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(Low_cnode_ptr \<mapsto> 10, High_cnode_ptr \<mapsto> 10, Silc_cnode_ptr \<mapsto> 10, irq_cnode_ptr \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = Low_tcb_ptr, ksIdleThread = idle_tcb_ptr, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState init_irq_node_ptr ((\<lambda>_. irqstate.IRQInactive)(timer_irq := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = arch_state0H, ksMachineState = machine_state0\<rparr>
 2. 1 \<le> maxDomain \<Longrightarrow> Invariants_H.valid_queues s0H_internal \<and> sym_refs (state_refs_of' s0H_internal) \<and> if_live_then_nonz_cap' s0H_internal \<and> if_unsafe_then_cap' s0H_internal \<and> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> \<exists>v. ksPSpace \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = init_globals_frame then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(Low_cnode_ptr \<mapsto> 10, High_cnode_ptr \<mapsto> 10, Silc_cnode_ptr \<mapsto> 10, irq_cnode_ptr \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = Low_tcb_ptr, ksIdleThread = idle_tcb_ptr, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState init_irq_node_ptr ((\<lambda>_. irqstate.IRQInactive)(timer_irq := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = arch_state0H, ksMachineState = machine_state0\<rparr> Low_tcb_ptr = Some v \<and> objBitsKO v = 9
 2. 1 \<le> maxDomain \<Longrightarrow> Invariants_H.valid_queues s0H_internal \<and> sym_refs (state_refs_of' s0H_internal) \<and> if_live_then_nonz_cap' s0H_internal \<and> if_unsafe_then_cap' s0H_internal \<and> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> Invariants_H.valid_queues s0H_internal \<and> sym_refs (state_refs_of' s0H_internal) \<and> if_live_then_nonz_cap' s0H_internal \<and> if_unsafe_then_cap' s0H_internal \<and> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> Invariants_H.valid_queues s0H_internal
 2. 1 \<le> maxDomain \<Longrightarrow> sym_refs (state_refs_of' s0H_internal) \<and> if_live_then_nonz_cap' s0H_internal \<and> if_unsafe_then_cap' s0H_internal \<and> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> sym_refs (state_refs_of' s0H_internal) \<and> if_live_then_nonz_cap' s0H_internal \<and> if_unsafe_then_cap' s0H_internal \<and> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> sym_refs (state_refs_of' s0H_internal)
 2. 1 \<le> maxDomain \<Longrightarrow> if_live_then_nonz_cap' s0H_internal \<and> if_unsafe_then_cap' s0H_internal \<and> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. \<And>x x2 a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO x2); ps_clear x (objBitsKO x2) s0H_internal; kh0H x = Some x2; (a, b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 2. 1 \<le> maxDomain \<Longrightarrow> if_live_then_nonz_cap' s0H_internal \<and> if_unsafe_then_cap' s0H_internal \<and> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. \<And>x x2 a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO x2); ps_clear x (objBitsKO x2) s0H_internal; kh0H x = Some x2; (a, b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x = init_globals_frame \<and> x2 = KOUserData \<or> x = idle_tcb_ptr \<and> x2 = KOTCB idle_tcbH \<or> x = High_tcb_ptr \<and> x2 = KOTCB High_tcbH \<or> x = Low_tcb_ptr \<and> x2 = KOTCB Low_tcbH \<or> x = ntfn_ptr \<and> x2 = KONotification ntfnH \<or> x = irq_cnode_ptr \<and> x2 = KOCTE irq_cte \<or> x \<in> irq_node_offs_range \<and> x2 = KOCTE (CTE capability.NullCap (MDB 0 0 False False)) \<or> x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> x2 = the (Low_cte Low_cnode_ptr x) \<or> x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> x2 = the (High_cte High_cnode_ptr x) \<or> x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> x2 = the (Silc_cte Silc_cnode_ptr x) \<or> x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> x2 = the (global_pdH' init_global_pd x) \<or> x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> x2 = the (High_pdH High_pd_ptr x) \<or> x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> x2 = the (Low_pdH Low_pd_ptr x) \<or> x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> x2 = the (High_ptH High_pt_ptr x) \<or> x \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr x \<noteq> None \<and> x2 = the (Low_ptH Low_pt_ptr x)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 2. 1 \<le> maxDomain \<Longrightarrow> if_live_then_nonz_cap' s0H_internal \<and> if_unsafe_then_cap' s0H_internal \<and> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (13 subgoals):
 1. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned idle_tcb_ptr (objBitsKO (KOTCB idle_tcbH)); ps_clear idle_tcb_ptr (objBitsKO (KOTCB idle_tcbH)) s0H_internal; (a, b) \<in> tcb_st_refs_of' (tcbState idle_tcbH) \<or> (a, b) \<in> tcb_bound_refs' (tcbBoundNotification idle_tcbH); x = idle_tcb_ptr\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (idle_tcb_ptr, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 2. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned High_tcb_ptr (objBitsKO (KOTCB High_tcbH)); ps_clear High_tcb_ptr (objBitsKO (KOTCB High_tcbH)) s0H_internal; (a, b) \<in> tcb_st_refs_of' (tcbState High_tcbH) \<or> (a, b) \<in> tcb_bound_refs' (tcbBoundNotification High_tcbH); x = High_tcb_ptr\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (High_tcb_ptr, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 3. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned Low_tcb_ptr (objBitsKO (KOTCB Low_tcbH)); ps_clear Low_tcb_ptr (objBitsKO (KOTCB Low_tcbH)) s0H_internal; (a, b) \<in> tcb_st_refs_of' (tcbState Low_tcbH) \<or> (a, b) \<in> tcb_bound_refs' (tcbBoundNotification Low_tcbH); x = Low_tcb_ptr\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (Low_tcb_ptr, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 4. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned ntfn_ptr (objBitsKO (KONotification ntfnH)); ps_clear ntfn_ptr (objBitsKO (KONotification ntfnH)) s0H_internal; (a, b) \<in> ntfn_q_refs_of' (ntfnObj ntfnH) \<or> (a, b) \<in> ntfn_bound_refs' (ntfnBoundTCB ntfnH); x = ntfn_ptr\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (ntfn_ptr, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 5. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_cte Low_cnode_ptr x))); ps_clear x (objBitsKO (the (Low_cte Low_cnode_ptr x))) s0H_internal; kh0H x = Low_cte Low_cnode_ptr x; (a, b) \<in> (case the (Low_cte Low_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. Low_cte Low_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 6. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_cte High_cnode_ptr x))); ps_clear x (objBitsKO (the (High_cte High_cnode_ptr x))) s0H_internal; kh0H x = High_cte High_cnode_ptr x; (a, b) \<in> (case the (High_cte High_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. High_cte High_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 7. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))); ps_clear x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))) s0H_internal; kh0H x = Silc_cte Silc_cnode_ptr x; (a, b) \<in> (case the (Silc_cte Silc_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. Silc_cte Silc_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 8. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (global_pdH' init_global_pd x))); ps_clear x (objBitsKO (the (global_pdH' init_global_pd x))) s0H_internal; kh0H x = global_pdH' init_global_pd x; (a, b) \<in> (case the (global_pdH' init_global_pd x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range init_global_pd \<and> (\<exists>y. global_pdH' init_global_pd x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 9. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_pdH High_pd_ptr x))); ps_clear x (objBitsKO (the (High_pdH High_pd_ptr x))) s0H_internal; kh0H x = High_pdH High_pd_ptr x; (a, b) \<in> (case the (High_pdH High_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. High_pdH High_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 10. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_pdH Low_pd_ptr x))); ps_clear x (objBitsKO (the (Low_pdH Low_pd_ptr x))) s0H_internal; kh0H x = Low_pdH Low_pd_ptr x; (a, b) \<in> (case the (Low_pdH Low_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. Low_pdH Low_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned High_tcb_ptr (objBitsKO (KOTCB High_tcbH)); ps_clear High_tcb_ptr (objBitsKO (KOTCB High_tcbH)) s0H_internal; (a, b) \<in> tcb_st_refs_of' (tcbState High_tcbH) \<or> (a, b) \<in> tcb_bound_refs' (tcbBoundNotification High_tcbH); x = High_tcb_ptr\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (High_tcb_ptr, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 2. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned Low_tcb_ptr (objBitsKO (KOTCB Low_tcbH)); ps_clear Low_tcb_ptr (objBitsKO (KOTCB Low_tcbH)) s0H_internal; (a, b) \<in> tcb_st_refs_of' (tcbState Low_tcbH) \<or> (a, b) \<in> tcb_bound_refs' (tcbBoundNotification Low_tcbH); x = Low_tcb_ptr\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (Low_tcb_ptr, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 3. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned ntfn_ptr (objBitsKO (KONotification ntfnH)); ps_clear ntfn_ptr (objBitsKO (KONotification ntfnH)) s0H_internal; (a, b) \<in> ntfn_q_refs_of' (ntfnObj ntfnH) \<or> (a, b) \<in> ntfn_bound_refs' (ntfnBoundTCB ntfnH); x = ntfn_ptr\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (ntfn_ptr, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 4. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_cte Low_cnode_ptr x))); ps_clear x (objBitsKO (the (Low_cte Low_cnode_ptr x))) s0H_internal; kh0H x = Low_cte Low_cnode_ptr x; (a, b) \<in> (case the (Low_cte Low_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. Low_cte Low_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 5. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_cte High_cnode_ptr x))); ps_clear x (objBitsKO (the (High_cte High_cnode_ptr x))) s0H_internal; kh0H x = High_cte High_cnode_ptr x; (a, b) \<in> (case the (High_cte High_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. High_cte High_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 6. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))); ps_clear x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))) s0H_internal; kh0H x = Silc_cte Silc_cnode_ptr x; (a, b) \<in> (case the (Silc_cte Silc_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. Silc_cte Silc_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 7. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (global_pdH' init_global_pd x))); ps_clear x (objBitsKO (the (global_pdH' init_global_pd x))) s0H_internal; kh0H x = global_pdH' init_global_pd x; (a, b) \<in> (case the (global_pdH' init_global_pd x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range init_global_pd \<and> (\<exists>y. global_pdH' init_global_pd x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 8. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_pdH High_pd_ptr x))); ps_clear x (objBitsKO (the (High_pdH High_pd_ptr x))) s0H_internal; kh0H x = High_pdH High_pd_ptr x; (a, b) \<in> (case the (High_pdH High_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. High_pdH High_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 9. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_pdH Low_pd_ptr x))); ps_clear x (objBitsKO (the (Low_pdH Low_pd_ptr x))) s0H_internal; kh0H x = Low_pdH Low_pd_ptr x; (a, b) \<in> (case the (Low_pdH Low_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. Low_pdH Low_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 10. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_ptH High_pt_ptr x))); ps_clear x (objBitsKO (the (High_ptH High_pt_ptr x))) s0H_internal; kh0H x = High_ptH High_pt_ptr x; (a, b) \<in> (case the (High_ptH High_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. High_ptH High_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x2. \<lbrakk>1 \<le> maxDomain; is_aligned High_tcb_ptr (objBitsKO (KOTCB (Thread (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False)) (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)) (CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)) (CTE capability.NullCap (MDB 0 0 False False)) (CTE capability.NullCap (MDB 0 0 False False)) High_domain (Structures_H.thread_state.BlockedOnNotification ntfn_ptr) High_mcp High_prio False None High_time_slice 0 0 None (ArchThread undefined)))); ps_clear High_tcb_ptr (objBitsKO (KOTCB (Thread (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False)) (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)) (CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)) (CTE capability.NullCap (MDB 0 0 False False)) (CTE capability.NullCap (MDB 0 0 False False)) High_domain (Structures_H.thread_state.BlockedOnNotification ntfn_ptr) High_mcp High_prio False None High_time_slice 0 0 None (ArchThread undefined)))) s0H_internal\<rbrakk> \<Longrightarrow> (is_aligned ntfn_ptr (objBitsKO x2) \<and> ps_clear ntfn_ptr (objBitsKO x2) s0H_internal \<longrightarrow> KONotification ntfnH = x2 \<longrightarrow> (High_tcb_ptr, NTFNSignal) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned ntfn_ptr (objBitsKO x2) \<longrightarrow> \<not> ps_clear ntfn_ptr (objBitsKO x2) s0H_internal) \<longrightarrow> KONotification ntfnH \<noteq> x2)
 2. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned Low_tcb_ptr (objBitsKO (KOTCB Low_tcbH)); ps_clear Low_tcb_ptr (objBitsKO (KOTCB Low_tcbH)) s0H_internal; (a, b) \<in> tcb_st_refs_of' (tcbState Low_tcbH) \<or> (a, b) \<in> tcb_bound_refs' (tcbBoundNotification Low_tcbH); x = Low_tcb_ptr\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (Low_tcb_ptr, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 3. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned ntfn_ptr (objBitsKO (KONotification ntfnH)); ps_clear ntfn_ptr (objBitsKO (KONotification ntfnH)) s0H_internal; (a, b) \<in> ntfn_q_refs_of' (ntfnObj ntfnH) \<or> (a, b) \<in> ntfn_bound_refs' (ntfnBoundTCB ntfnH); x = ntfn_ptr\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (ntfn_ptr, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 4. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_cte Low_cnode_ptr x))); ps_clear x (objBitsKO (the (Low_cte Low_cnode_ptr x))) s0H_internal; kh0H x = Low_cte Low_cnode_ptr x; (a, b) \<in> (case the (Low_cte Low_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. Low_cte Low_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 5. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_cte High_cnode_ptr x))); ps_clear x (objBitsKO (the (High_cte High_cnode_ptr x))) s0H_internal; kh0H x = High_cte High_cnode_ptr x; (a, b) \<in> (case the (High_cte High_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. High_cte High_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 6. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))); ps_clear x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))) s0H_internal; kh0H x = Silc_cte Silc_cnode_ptr x; (a, b) \<in> (case the (Silc_cte Silc_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. Silc_cte Silc_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 7. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (global_pdH' init_global_pd x))); ps_clear x (objBitsKO (the (global_pdH' init_global_pd x))) s0H_internal; kh0H x = global_pdH' init_global_pd x; (a, b) \<in> (case the (global_pdH' init_global_pd x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range init_global_pd \<and> (\<exists>y. global_pdH' init_global_pd x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 8. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_pdH High_pd_ptr x))); ps_clear x (objBitsKO (the (High_pdH High_pd_ptr x))) s0H_internal; kh0H x = High_pdH High_pd_ptr x; (a, b) \<in> (case the (High_pdH High_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. High_pdH High_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 9. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_pdH Low_pd_ptr x))); ps_clear x (objBitsKO (the (Low_pdH Low_pd_ptr x))) s0H_internal; kh0H x = Low_pdH Low_pd_ptr x; (a, b) \<in> (case the (Low_pdH Low_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. Low_pdH Low_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 10. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_ptH High_pt_ptr x))); ps_clear x (objBitsKO (the (High_ptH High_pt_ptr x))) s0H_internal; kh0H x = High_ptH High_pt_ptr x; (a, b) \<in> (case the (High_ptH High_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. High_ptH High_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>x2. \<lbrakk>1 \<le> maxDomain; is_aligned High_tcb_ptr (objBitsKO (KOTCB (Thread (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False)) (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)) (CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)) (CTE capability.NullCap (MDB 0 0 False False)) (CTE capability.NullCap (MDB 0 0 False False)) High_domain (Structures_H.thread_state.BlockedOnNotification ntfn_ptr) High_mcp High_prio False None High_time_slice 0 0 None (ArchThread undefined)))); ps_clear High_tcb_ptr (objBitsKO (KOTCB (Thread (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False)) (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)) (CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)) (CTE capability.NullCap (MDB 0 0 False False)) (CTE capability.NullCap (MDB 0 0 False False)) High_domain (Structures_H.thread_state.BlockedOnNotification ntfn_ptr) High_mcp High_prio False None High_time_slice 0 0 None (ArchThread undefined)))) s0H_internal\<rbrakk> \<Longrightarrow> is_aligned ntfn_ptr (objBitsKO x2) \<and> ps_clear ntfn_ptr (objBitsKO x2) s0H_internal \<longrightarrow> KONotification ntfnH = x2 \<longrightarrow> (High_tcb_ptr, NTFNSignal) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})
 2. \<And>x2. \<lbrakk>1 \<le> maxDomain; is_aligned High_tcb_ptr (objBitsKO (KOTCB (Thread (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False)) (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)) (CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)) (CTE capability.NullCap (MDB 0 0 False False)) (CTE capability.NullCap (MDB 0 0 False False)) High_domain (Structures_H.thread_state.BlockedOnNotification ntfn_ptr) High_mcp High_prio False None High_time_slice 0 0 None (ArchThread undefined)))); ps_clear High_tcb_ptr (objBitsKO (KOTCB (Thread (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False)) (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)) (CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)) (CTE capability.NullCap (MDB 0 0 False False)) (CTE capability.NullCap (MDB 0 0 False False)) High_domain (Structures_H.thread_state.BlockedOnNotification ntfn_ptr) High_mcp High_prio False None High_time_slice 0 0 None (ArchThread undefined)))) s0H_internal\<rbrakk> \<Longrightarrow> (is_aligned ntfn_ptr (objBitsKO x2) \<longrightarrow> \<not> ps_clear ntfn_ptr (objBitsKO x2) s0H_internal) \<longrightarrow> KONotification ntfnH \<noteq> x2
 3. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned Low_tcb_ptr (objBitsKO (KOTCB Low_tcbH)); ps_clear Low_tcb_ptr (objBitsKO (KOTCB Low_tcbH)) s0H_internal; (a, b) \<in> tcb_st_refs_of' (tcbState Low_tcbH) \<or> (a, b) \<in> tcb_bound_refs' (tcbBoundNotification Low_tcbH); x = Low_tcb_ptr\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (Low_tcb_ptr, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 4. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned ntfn_ptr (objBitsKO (KONotification ntfnH)); ps_clear ntfn_ptr (objBitsKO (KONotification ntfnH)) s0H_internal; (a, b) \<in> ntfn_q_refs_of' (ntfnObj ntfnH) \<or> (a, b) \<in> ntfn_bound_refs' (ntfnBoundTCB ntfnH); x = ntfn_ptr\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (ntfn_ptr, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 5. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_cte Low_cnode_ptr x))); ps_clear x (objBitsKO (the (Low_cte Low_cnode_ptr x))) s0H_internal; kh0H x = Low_cte Low_cnode_ptr x; (a, b) \<in> (case the (Low_cte Low_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. Low_cte Low_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 6. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_cte High_cnode_ptr x))); ps_clear x (objBitsKO (the (High_cte High_cnode_ptr x))) s0H_internal; kh0H x = High_cte High_cnode_ptr x; (a, b) \<in> (case the (High_cte High_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. High_cte High_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 7. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))); ps_clear x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))) s0H_internal; kh0H x = Silc_cte Silc_cnode_ptr x; (a, b) \<in> (case the (Silc_cte Silc_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. Silc_cte Silc_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 8. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (global_pdH' init_global_pd x))); ps_clear x (objBitsKO (the (global_pdH' init_global_pd x))) s0H_internal; kh0H x = global_pdH' init_global_pd x; (a, b) \<in> (case the (global_pdH' init_global_pd x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range init_global_pd \<and> (\<exists>y. global_pdH' init_global_pd x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 9. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_pdH High_pd_ptr x))); ps_clear x (objBitsKO (the (High_pdH High_pd_ptr x))) s0H_internal; kh0H x = High_pdH High_pd_ptr x; (a, b) \<in> (case the (High_pdH High_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. High_pdH High_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 10. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_pdH Low_pd_ptr x))); ps_clear x (objBitsKO (the (Low_pdH Low_pd_ptr x))) s0H_internal; kh0H x = Low_pdH Low_pd_ptr x; (a, b) \<in> (case the (Low_pdH Low_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. Low_pdH Low_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x2. \<lbrakk>1 \<le> maxDomain; is_aligned High_tcb_ptr (objBitsKO (KOTCB (Thread (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False)) (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)) (CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)) (CTE capability.NullCap (MDB 0 0 False False)) (CTE capability.NullCap (MDB 0 0 False False)) High_domain (Structures_H.thread_state.BlockedOnNotification ntfn_ptr) High_mcp High_prio False None High_time_slice 0 0 None (ArchThread undefined)))); ps_clear High_tcb_ptr (objBitsKO (KOTCB (Thread (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False)) (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)) (CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)) (CTE capability.NullCap (MDB 0 0 False False)) (CTE capability.NullCap (MDB 0 0 False False)) High_domain (Structures_H.thread_state.BlockedOnNotification ntfn_ptr) High_mcp High_prio False None High_time_slice 0 0 None (ArchThread undefined)))) s0H_internal\<rbrakk> \<Longrightarrow> (is_aligned ntfn_ptr (objBitsKO x2) \<longrightarrow> \<not> ps_clear ntfn_ptr (objBitsKO x2) s0H_internal) \<longrightarrow> KONotification ntfnH \<noteq> x2
 2. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned Low_tcb_ptr (objBitsKO (KOTCB Low_tcbH)); ps_clear Low_tcb_ptr (objBitsKO (KOTCB Low_tcbH)) s0H_internal; (a, b) \<in> tcb_st_refs_of' (tcbState Low_tcbH) \<or> (a, b) \<in> tcb_bound_refs' (tcbBoundNotification Low_tcbH); x = Low_tcb_ptr\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (Low_tcb_ptr, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 3. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned ntfn_ptr (objBitsKO (KONotification ntfnH)); ps_clear ntfn_ptr (objBitsKO (KONotification ntfnH)) s0H_internal; (a, b) \<in> ntfn_q_refs_of' (ntfnObj ntfnH) \<or> (a, b) \<in> ntfn_bound_refs' (ntfnBoundTCB ntfnH); x = ntfn_ptr\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (ntfn_ptr, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 4. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_cte Low_cnode_ptr x))); ps_clear x (objBitsKO (the (Low_cte Low_cnode_ptr x))) s0H_internal; kh0H x = Low_cte Low_cnode_ptr x; (a, b) \<in> (case the (Low_cte Low_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. Low_cte Low_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 5. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_cte High_cnode_ptr x))); ps_clear x (objBitsKO (the (High_cte High_cnode_ptr x))) s0H_internal; kh0H x = High_cte High_cnode_ptr x; (a, b) \<in> (case the (High_cte High_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. High_cte High_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 6. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))); ps_clear x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))) s0H_internal; kh0H x = Silc_cte Silc_cnode_ptr x; (a, b) \<in> (case the (Silc_cte Silc_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. Silc_cte Silc_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 7. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (global_pdH' init_global_pd x))); ps_clear x (objBitsKO (the (global_pdH' init_global_pd x))) s0H_internal; kh0H x = global_pdH' init_global_pd x; (a, b) \<in> (case the (global_pdH' init_global_pd x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range init_global_pd \<and> (\<exists>y. global_pdH' init_global_pd x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 8. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_pdH High_pd_ptr x))); ps_clear x (objBitsKO (the (High_pdH High_pd_ptr x))) s0H_internal; kh0H x = High_pdH High_pd_ptr x; (a, b) \<in> (case the (High_pdH High_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. High_pdH High_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 9. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_pdH Low_pd_ptr x))); ps_clear x (objBitsKO (the (Low_pdH Low_pd_ptr x))) s0H_internal; kh0H x = Low_pdH Low_pd_ptr x; (a, b) \<in> (case the (Low_pdH Low_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. Low_pdH Low_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 10. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_ptH High_pt_ptr x))); ps_clear x (objBitsKO (the (High_ptH High_pt_ptr x))) s0H_internal; kh0H x = High_ptH High_pt_ptr x; (a, b) \<in> (case the (High_ptH High_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. High_ptH High_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<lbrakk>1 \<le> maxDomain; is_aligned High_tcb_ptr 9; ps_clear High_tcb_ptr 9 s0H_internal; is_aligned ntfn_ptr 4 \<longrightarrow> \<not> ps_clear ntfn_ptr 4 s0H_internal\<rbrakk> \<Longrightarrow> False
 2. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned Low_tcb_ptr (objBitsKO (KOTCB Low_tcbH)); ps_clear Low_tcb_ptr (objBitsKO (KOTCB Low_tcbH)) s0H_internal; (a, b) \<in> tcb_st_refs_of' (tcbState Low_tcbH) \<or> (a, b) \<in> tcb_bound_refs' (tcbBoundNotification Low_tcbH); x = Low_tcb_ptr\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (Low_tcb_ptr, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 3. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned ntfn_ptr (objBitsKO (KONotification ntfnH)); ps_clear ntfn_ptr (objBitsKO (KONotification ntfnH)) s0H_internal; (a, b) \<in> ntfn_q_refs_of' (ntfnObj ntfnH) \<or> (a, b) \<in> ntfn_bound_refs' (ntfnBoundTCB ntfnH); x = ntfn_ptr\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (ntfn_ptr, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 4. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_cte Low_cnode_ptr x))); ps_clear x (objBitsKO (the (Low_cte Low_cnode_ptr x))) s0H_internal; kh0H x = Low_cte Low_cnode_ptr x; (a, b) \<in> (case the (Low_cte Low_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. Low_cte Low_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 5. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_cte High_cnode_ptr x))); ps_clear x (objBitsKO (the (High_cte High_cnode_ptr x))) s0H_internal; kh0H x = High_cte High_cnode_ptr x; (a, b) \<in> (case the (High_cte High_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. High_cte High_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 6. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))); ps_clear x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))) s0H_internal; kh0H x = Silc_cte Silc_cnode_ptr x; (a, b) \<in> (case the (Silc_cte Silc_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. Silc_cte Silc_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 7. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (global_pdH' init_global_pd x))); ps_clear x (objBitsKO (the (global_pdH' init_global_pd x))) s0H_internal; kh0H x = global_pdH' init_global_pd x; (a, b) \<in> (case the (global_pdH' init_global_pd x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range init_global_pd \<and> (\<exists>y. global_pdH' init_global_pd x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 8. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_pdH High_pd_ptr x))); ps_clear x (objBitsKO (the (High_pdH High_pd_ptr x))) s0H_internal; kh0H x = High_pdH High_pd_ptr x; (a, b) \<in> (case the (High_pdH High_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. High_pdH High_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 9. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_pdH Low_pd_ptr x))); ps_clear x (objBitsKO (the (Low_pdH Low_pd_ptr x))) s0H_internal; kh0H x = Low_pdH Low_pd_ptr x; (a, b) \<in> (case the (Low_pdH Low_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. Low_pdH Low_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 10. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_ptH High_pt_ptr x))); ps_clear x (objBitsKO (the (High_ptH High_pt_ptr x))) s0H_internal; kh0H x = High_ptH High_pt_ptr x; (a, b) \<in> (case the (High_ptH High_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. High_ptH High_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<lbrakk>1 \<le> maxDomain; is_aligned High_tcb_ptr 9; ps_clear High_tcb_ptr 9 s0H_internal; \<not> ps_clear ntfn_ptr 4 s0H_internal\<rbrakk> \<Longrightarrow> False
 2. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned Low_tcb_ptr (objBitsKO (KOTCB Low_tcbH)); ps_clear Low_tcb_ptr (objBitsKO (KOTCB Low_tcbH)) s0H_internal; (a, b) \<in> tcb_st_refs_of' (tcbState Low_tcbH) \<or> (a, b) \<in> tcb_bound_refs' (tcbBoundNotification Low_tcbH); x = Low_tcb_ptr\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (Low_tcb_ptr, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 3. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned ntfn_ptr (objBitsKO (KONotification ntfnH)); ps_clear ntfn_ptr (objBitsKO (KONotification ntfnH)) s0H_internal; (a, b) \<in> ntfn_q_refs_of' (ntfnObj ntfnH) \<or> (a, b) \<in> ntfn_bound_refs' (ntfnBoundTCB ntfnH); x = ntfn_ptr\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (ntfn_ptr, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 4. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_cte Low_cnode_ptr x))); ps_clear x (objBitsKO (the (Low_cte Low_cnode_ptr x))) s0H_internal; kh0H x = Low_cte Low_cnode_ptr x; (a, b) \<in> (case the (Low_cte Low_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. Low_cte Low_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 5. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_cte High_cnode_ptr x))); ps_clear x (objBitsKO (the (High_cte High_cnode_ptr x))) s0H_internal; kh0H x = High_cte High_cnode_ptr x; (a, b) \<in> (case the (High_cte High_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. High_cte High_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 6. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))); ps_clear x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))) s0H_internal; kh0H x = Silc_cte Silc_cnode_ptr x; (a, b) \<in> (case the (Silc_cte Silc_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. Silc_cte Silc_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 7. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (global_pdH' init_global_pd x))); ps_clear x (objBitsKO (the (global_pdH' init_global_pd x))) s0H_internal; kh0H x = global_pdH' init_global_pd x; (a, b) \<in> (case the (global_pdH' init_global_pd x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range init_global_pd \<and> (\<exists>y. global_pdH' init_global_pd x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 8. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_pdH High_pd_ptr x))); ps_clear x (objBitsKO (the (High_pdH High_pd_ptr x))) s0H_internal; kh0H x = High_pdH High_pd_ptr x; (a, b) \<in> (case the (High_pdH High_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. High_pdH High_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 9. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_pdH Low_pd_ptr x))); ps_clear x (objBitsKO (the (Low_pdH Low_pd_ptr x))) s0H_internal; kh0H x = Low_pdH Low_pd_ptr x; (a, b) \<in> (case the (Low_pdH Low_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. Low_pdH Low_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 10. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_ptH High_pt_ptr x))); ps_clear x (objBitsKO (the (High_ptH High_pt_ptr x))) s0H_internal; kh0H x = High_ptH High_pt_ptr x; (a, b) \<in> (case the (High_ptH High_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. High_ptH High_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<lbrakk>1 \<le> maxDomain; is_aligned High_tcb_ptr 9; ps_clear High_tcb_ptr 9 s0H_internal\<rbrakk> \<Longrightarrow> \<exists>v. ksPSpace s0H_internal ntfn_ptr = Some v \<and> objBitsKO v = 4
 2. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned Low_tcb_ptr (objBitsKO (KOTCB Low_tcbH)); ps_clear Low_tcb_ptr (objBitsKO (KOTCB Low_tcbH)) s0H_internal; (a, b) \<in> tcb_st_refs_of' (tcbState Low_tcbH) \<or> (a, b) \<in> tcb_bound_refs' (tcbBoundNotification Low_tcbH); x = Low_tcb_ptr\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (Low_tcb_ptr, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 3. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned ntfn_ptr (objBitsKO (KONotification ntfnH)); ps_clear ntfn_ptr (objBitsKO (KONotification ntfnH)) s0H_internal; (a, b) \<in> ntfn_q_refs_of' (ntfnObj ntfnH) \<or> (a, b) \<in> ntfn_bound_refs' (ntfnBoundTCB ntfnH); x = ntfn_ptr\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (ntfn_ptr, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 4. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_cte Low_cnode_ptr x))); ps_clear x (objBitsKO (the (Low_cte Low_cnode_ptr x))) s0H_internal; kh0H x = Low_cte Low_cnode_ptr x; (a, b) \<in> (case the (Low_cte Low_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. Low_cte Low_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 5. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_cte High_cnode_ptr x))); ps_clear x (objBitsKO (the (High_cte High_cnode_ptr x))) s0H_internal; kh0H x = High_cte High_cnode_ptr x; (a, b) \<in> (case the (High_cte High_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. High_cte High_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 6. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))); ps_clear x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))) s0H_internal; kh0H x = Silc_cte Silc_cnode_ptr x; (a, b) \<in> (case the (Silc_cte Silc_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. Silc_cte Silc_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 7. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (global_pdH' init_global_pd x))); ps_clear x (objBitsKO (the (global_pdH' init_global_pd x))) s0H_internal; kh0H x = global_pdH' init_global_pd x; (a, b) \<in> (case the (global_pdH' init_global_pd x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range init_global_pd \<and> (\<exists>y. global_pdH' init_global_pd x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 8. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_pdH High_pd_ptr x))); ps_clear x (objBitsKO (the (High_pdH High_pd_ptr x))) s0H_internal; kh0H x = High_pdH High_pd_ptr x; (a, b) \<in> (case the (High_pdH High_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. High_pdH High_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 9. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_pdH Low_pd_ptr x))); ps_clear x (objBitsKO (the (Low_pdH Low_pd_ptr x))) s0H_internal; kh0H x = Low_pdH Low_pd_ptr x; (a, b) \<in> (case the (Low_pdH Low_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. Low_pdH Low_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 10. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_ptH High_pt_ptr x))); ps_clear x (objBitsKO (the (High_ptH High_pt_ptr x))) s0H_internal; kh0H x = High_ptH High_pt_ptr x; (a, b) \<in> (case the (High_ptH High_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. High_ptH High_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned Low_tcb_ptr (objBitsKO (KOTCB Low_tcbH)); ps_clear Low_tcb_ptr (objBitsKO (KOTCB Low_tcbH)) s0H_internal; (a, b) \<in> tcb_st_refs_of' (tcbState Low_tcbH) \<or> (a, b) \<in> tcb_bound_refs' (tcbBoundNotification Low_tcbH); x = Low_tcb_ptr\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (Low_tcb_ptr, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 2. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned ntfn_ptr (objBitsKO (KONotification ntfnH)); ps_clear ntfn_ptr (objBitsKO (KONotification ntfnH)) s0H_internal; (a, b) \<in> ntfn_q_refs_of' (ntfnObj ntfnH) \<or> (a, b) \<in> ntfn_bound_refs' (ntfnBoundTCB ntfnH); x = ntfn_ptr\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (ntfn_ptr, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 3. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_cte Low_cnode_ptr x))); ps_clear x (objBitsKO (the (Low_cte Low_cnode_ptr x))) s0H_internal; kh0H x = Low_cte Low_cnode_ptr x; (a, b) \<in> (case the (Low_cte Low_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. Low_cte Low_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 4. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_cte High_cnode_ptr x))); ps_clear x (objBitsKO (the (High_cte High_cnode_ptr x))) s0H_internal; kh0H x = High_cte High_cnode_ptr x; (a, b) \<in> (case the (High_cte High_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. High_cte High_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 5. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))); ps_clear x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))) s0H_internal; kh0H x = Silc_cte Silc_cnode_ptr x; (a, b) \<in> (case the (Silc_cte Silc_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. Silc_cte Silc_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 6. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (global_pdH' init_global_pd x))); ps_clear x (objBitsKO (the (global_pdH' init_global_pd x))) s0H_internal; kh0H x = global_pdH' init_global_pd x; (a, b) \<in> (case the (global_pdH' init_global_pd x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range init_global_pd \<and> (\<exists>y. global_pdH' init_global_pd x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 7. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_pdH High_pd_ptr x))); ps_clear x (objBitsKO (the (High_pdH High_pd_ptr x))) s0H_internal; kh0H x = High_pdH High_pd_ptr x; (a, b) \<in> (case the (High_pdH High_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. High_pdH High_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 8. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_pdH Low_pd_ptr x))); ps_clear x (objBitsKO (the (Low_pdH Low_pd_ptr x))) s0H_internal; kh0H x = Low_pdH Low_pd_ptr x; (a, b) \<in> (case the (Low_pdH Low_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. Low_pdH Low_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 9. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_ptH High_pt_ptr x))); ps_clear x (objBitsKO (the (High_ptH High_pt_ptr x))) s0H_internal; kh0H x = High_ptH High_pt_ptr x; (a, b) \<in> (case the (High_ptH High_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. High_ptH High_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 10. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_ptH Low_pt_ptr x))); ps_clear x (objBitsKO (the (Low_ptH Low_pt_ptr x))) s0H_internal; kh0H x = Low_ptH Low_pt_ptr x; (a, b) \<in> (case the (Low_ptH Low_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. Low_ptH Low_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned ntfn_ptr (objBitsKO (KONotification ntfnH)); ps_clear ntfn_ptr (objBitsKO (KONotification ntfnH)) s0H_internal; (a, b) \<in> ntfn_q_refs_of' (ntfnObj ntfnH) \<or> (a, b) \<in> ntfn_bound_refs' (ntfnBoundTCB ntfnH); x = ntfn_ptr\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (ntfn_ptr, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 2. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_cte Low_cnode_ptr x))); ps_clear x (objBitsKO (the (Low_cte Low_cnode_ptr x))) s0H_internal; kh0H x = Low_cte Low_cnode_ptr x; (a, b) \<in> (case the (Low_cte Low_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. Low_cte Low_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 3. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_cte High_cnode_ptr x))); ps_clear x (objBitsKO (the (High_cte High_cnode_ptr x))) s0H_internal; kh0H x = High_cte High_cnode_ptr x; (a, b) \<in> (case the (High_cte High_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. High_cte High_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 4. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))); ps_clear x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))) s0H_internal; kh0H x = Silc_cte Silc_cnode_ptr x; (a, b) \<in> (case the (Silc_cte Silc_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. Silc_cte Silc_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 5. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (global_pdH' init_global_pd x))); ps_clear x (objBitsKO (the (global_pdH' init_global_pd x))) s0H_internal; kh0H x = global_pdH' init_global_pd x; (a, b) \<in> (case the (global_pdH' init_global_pd x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range init_global_pd \<and> (\<exists>y. global_pdH' init_global_pd x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 6. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_pdH High_pd_ptr x))); ps_clear x (objBitsKO (the (High_pdH High_pd_ptr x))) s0H_internal; kh0H x = High_pdH High_pd_ptr x; (a, b) \<in> (case the (High_pdH High_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. High_pdH High_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 7. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_pdH Low_pd_ptr x))); ps_clear x (objBitsKO (the (Low_pdH Low_pd_ptr x))) s0H_internal; kh0H x = Low_pdH Low_pd_ptr x; (a, b) \<in> (case the (Low_pdH Low_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. Low_pdH Low_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 8. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_ptH High_pt_ptr x))); ps_clear x (objBitsKO (the (High_ptH High_pt_ptr x))) s0H_internal; kh0H x = High_ptH High_pt_ptr x; (a, b) \<in> (case the (High_ptH High_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. High_ptH High_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 9. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_ptH Low_pt_ptr x))); ps_clear x (objBitsKO (the (Low_ptH Low_pt_ptr x))) s0H_internal; kh0H x = Low_ptH Low_pt_ptr x; (a, b) \<in> (case the (Low_ptH Low_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. Low_ptH Low_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 10. 1 \<le> maxDomain \<Longrightarrow> if_live_then_nonz_cap' s0H_internal \<and> if_unsafe_then_cap' s0H_internal \<and> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (10 subgoals):
 1. \<And>x2. \<lbrakk>1 \<le> maxDomain; is_aligned ntfn_ptr (objBitsKO (KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [High_tcb_ptr]) None))); ps_clear ntfn_ptr (objBitsKO (KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [High_tcb_ptr]) None))) s0H_internal\<rbrakk> \<Longrightarrow> (is_aligned High_tcb_ptr (objBitsKO x2) \<and> ps_clear High_tcb_ptr (objBitsKO x2) s0H_internal \<longrightarrow> KOTCB High_tcbH = x2 \<longrightarrow> (ntfn_ptr, TCBSignal) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned High_tcb_ptr (objBitsKO x2) \<longrightarrow> \<not> ps_clear High_tcb_ptr (objBitsKO x2) s0H_internal) \<longrightarrow> KOTCB High_tcbH \<noteq> x2)
 2. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_cte Low_cnode_ptr x))); ps_clear x (objBitsKO (the (Low_cte Low_cnode_ptr x))) s0H_internal; kh0H x = Low_cte Low_cnode_ptr x; (a, b) \<in> (case the (Low_cte Low_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. Low_cte Low_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 3. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_cte High_cnode_ptr x))); ps_clear x (objBitsKO (the (High_cte High_cnode_ptr x))) s0H_internal; kh0H x = High_cte High_cnode_ptr x; (a, b) \<in> (case the (High_cte High_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. High_cte High_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 4. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))); ps_clear x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))) s0H_internal; kh0H x = Silc_cte Silc_cnode_ptr x; (a, b) \<in> (case the (Silc_cte Silc_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. Silc_cte Silc_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 5. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (global_pdH' init_global_pd x))); ps_clear x (objBitsKO (the (global_pdH' init_global_pd x))) s0H_internal; kh0H x = global_pdH' init_global_pd x; (a, b) \<in> (case the (global_pdH' init_global_pd x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range init_global_pd \<and> (\<exists>y. global_pdH' init_global_pd x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 6. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_pdH High_pd_ptr x))); ps_clear x (objBitsKO (the (High_pdH High_pd_ptr x))) s0H_internal; kh0H x = High_pdH High_pd_ptr x; (a, b) \<in> (case the (High_pdH High_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. High_pdH High_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 7. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_pdH Low_pd_ptr x))); ps_clear x (objBitsKO (the (Low_pdH Low_pd_ptr x))) s0H_internal; kh0H x = Low_pdH Low_pd_ptr x; (a, b) \<in> (case the (Low_pdH Low_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. Low_pdH Low_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 8. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_ptH High_pt_ptr x))); ps_clear x (objBitsKO (the (High_ptH High_pt_ptr x))) s0H_internal; kh0H x = High_ptH High_pt_ptr x; (a, b) \<in> (case the (High_ptH High_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. High_ptH High_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 9. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_ptH Low_pt_ptr x))); ps_clear x (objBitsKO (the (Low_ptH Low_pt_ptr x))) s0H_internal; kh0H x = Low_ptH Low_pt_ptr x; (a, b) \<in> (case the (Low_ptH Low_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. Low_ptH Low_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 10. 1 \<le> maxDomain \<Longrightarrow> if_live_then_nonz_cap' s0H_internal \<and> if_unsafe_then_cap' s0H_internal \<and> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (11 subgoals):
 1. \<And>x2. \<lbrakk>1 \<le> maxDomain; is_aligned ntfn_ptr (objBitsKO (KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [High_tcb_ptr]) None))); ps_clear ntfn_ptr (objBitsKO (KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [High_tcb_ptr]) None))) s0H_internal\<rbrakk> \<Longrightarrow> is_aligned High_tcb_ptr (objBitsKO x2) \<and> ps_clear High_tcb_ptr (objBitsKO x2) s0H_internal \<longrightarrow> KOTCB High_tcbH = x2 \<longrightarrow> (ntfn_ptr, TCBSignal) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})
 2. \<And>x2. \<lbrakk>1 \<le> maxDomain; is_aligned ntfn_ptr (objBitsKO (KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [High_tcb_ptr]) None))); ps_clear ntfn_ptr (objBitsKO (KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [High_tcb_ptr]) None))) s0H_internal\<rbrakk> \<Longrightarrow> (is_aligned High_tcb_ptr (objBitsKO x2) \<longrightarrow> \<not> ps_clear High_tcb_ptr (objBitsKO x2) s0H_internal) \<longrightarrow> KOTCB High_tcbH \<noteq> x2
 3. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_cte Low_cnode_ptr x))); ps_clear x (objBitsKO (the (Low_cte Low_cnode_ptr x))) s0H_internal; kh0H x = Low_cte Low_cnode_ptr x; (a, b) \<in> (case the (Low_cte Low_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. Low_cte Low_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 4. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_cte High_cnode_ptr x))); ps_clear x (objBitsKO (the (High_cte High_cnode_ptr x))) s0H_internal; kh0H x = High_cte High_cnode_ptr x; (a, b) \<in> (case the (High_cte High_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. High_cte High_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 5. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))); ps_clear x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))) s0H_internal; kh0H x = Silc_cte Silc_cnode_ptr x; (a, b) \<in> (case the (Silc_cte Silc_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. Silc_cte Silc_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 6. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (global_pdH' init_global_pd x))); ps_clear x (objBitsKO (the (global_pdH' init_global_pd x))) s0H_internal; kh0H x = global_pdH' init_global_pd x; (a, b) \<in> (case the (global_pdH' init_global_pd x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range init_global_pd \<and> (\<exists>y. global_pdH' init_global_pd x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 7. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_pdH High_pd_ptr x))); ps_clear x (objBitsKO (the (High_pdH High_pd_ptr x))) s0H_internal; kh0H x = High_pdH High_pd_ptr x; (a, b) \<in> (case the (High_pdH High_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. High_pdH High_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 8. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_pdH Low_pd_ptr x))); ps_clear x (objBitsKO (the (Low_pdH Low_pd_ptr x))) s0H_internal; kh0H x = Low_pdH Low_pd_ptr x; (a, b) \<in> (case the (Low_pdH Low_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. Low_pdH Low_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 9. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_ptH High_pt_ptr x))); ps_clear x (objBitsKO (the (High_ptH High_pt_ptr x))) s0H_internal; kh0H x = High_ptH High_pt_ptr x; (a, b) \<in> (case the (High_ptH High_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. High_ptH High_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 10. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_ptH Low_pt_ptr x))); ps_clear x (objBitsKO (the (Low_ptH Low_pt_ptr x))) s0H_internal; kh0H x = Low_ptH Low_pt_ptr x; (a, b) \<in> (case the (Low_ptH Low_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. Low_ptH Low_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>x2. \<lbrakk>1 \<le> maxDomain; is_aligned ntfn_ptr (objBitsKO (KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [High_tcb_ptr]) None))); ps_clear ntfn_ptr (objBitsKO (KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [High_tcb_ptr]) None))) s0H_internal\<rbrakk> \<Longrightarrow> (is_aligned High_tcb_ptr (objBitsKO x2) \<longrightarrow> \<not> ps_clear High_tcb_ptr (objBitsKO x2) s0H_internal) \<longrightarrow> KOTCB High_tcbH \<noteq> x2
 2. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_cte Low_cnode_ptr x))); ps_clear x (objBitsKO (the (Low_cte Low_cnode_ptr x))) s0H_internal; kh0H x = Low_cte Low_cnode_ptr x; (a, b) \<in> (case the (Low_cte Low_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. Low_cte Low_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 3. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_cte High_cnode_ptr x))); ps_clear x (objBitsKO (the (High_cte High_cnode_ptr x))) s0H_internal; kh0H x = High_cte High_cnode_ptr x; (a, b) \<in> (case the (High_cte High_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. High_cte High_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 4. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))); ps_clear x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))) s0H_internal; kh0H x = Silc_cte Silc_cnode_ptr x; (a, b) \<in> (case the (Silc_cte Silc_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. Silc_cte Silc_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 5. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (global_pdH' init_global_pd x))); ps_clear x (objBitsKO (the (global_pdH' init_global_pd x))) s0H_internal; kh0H x = global_pdH' init_global_pd x; (a, b) \<in> (case the (global_pdH' init_global_pd x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range init_global_pd \<and> (\<exists>y. global_pdH' init_global_pd x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 6. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_pdH High_pd_ptr x))); ps_clear x (objBitsKO (the (High_pdH High_pd_ptr x))) s0H_internal; kh0H x = High_pdH High_pd_ptr x; (a, b) \<in> (case the (High_pdH High_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. High_pdH High_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 7. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_pdH Low_pd_ptr x))); ps_clear x (objBitsKO (the (Low_pdH Low_pd_ptr x))) s0H_internal; kh0H x = Low_pdH Low_pd_ptr x; (a, b) \<in> (case the (Low_pdH Low_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. Low_pdH Low_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 8. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_ptH High_pt_ptr x))); ps_clear x (objBitsKO (the (High_ptH High_pt_ptr x))) s0H_internal; kh0H x = High_ptH High_pt_ptr x; (a, b) \<in> (case the (High_ptH High_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. High_ptH High_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 9. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_ptH Low_pt_ptr x))); ps_clear x (objBitsKO (the (Low_ptH Low_pt_ptr x))) s0H_internal; kh0H x = Low_ptH Low_pt_ptr x; (a, b) \<in> (case the (Low_ptH Low_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. Low_ptH Low_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 10. 1 \<le> maxDomain \<Longrightarrow> if_live_then_nonz_cap' s0H_internal \<and> if_unsafe_then_cap' s0H_internal \<and> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (10 subgoals):
 1. \<lbrakk>1 \<le> maxDomain; ps_clear ntfn_ptr 4 s0H_internal; \<not> ps_clear High_tcb_ptr 9 s0H_internal\<rbrakk> \<Longrightarrow> False
 2. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_cte Low_cnode_ptr x))); ps_clear x (objBitsKO (the (Low_cte Low_cnode_ptr x))) s0H_internal; kh0H x = Low_cte Low_cnode_ptr x; (a, b) \<in> (case the (Low_cte Low_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. Low_cte Low_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 3. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_cte High_cnode_ptr x))); ps_clear x (objBitsKO (the (High_cte High_cnode_ptr x))) s0H_internal; kh0H x = High_cte High_cnode_ptr x; (a, b) \<in> (case the (High_cte High_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. High_cte High_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 4. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))); ps_clear x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))) s0H_internal; kh0H x = Silc_cte Silc_cnode_ptr x; (a, b) \<in> (case the (Silc_cte Silc_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. Silc_cte Silc_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 5. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (global_pdH' init_global_pd x))); ps_clear x (objBitsKO (the (global_pdH' init_global_pd x))) s0H_internal; kh0H x = global_pdH' init_global_pd x; (a, b) \<in> (case the (global_pdH' init_global_pd x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range init_global_pd \<and> (\<exists>y. global_pdH' init_global_pd x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 6. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_pdH High_pd_ptr x))); ps_clear x (objBitsKO (the (High_pdH High_pd_ptr x))) s0H_internal; kh0H x = High_pdH High_pd_ptr x; (a, b) \<in> (case the (High_pdH High_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. High_pdH High_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 7. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_pdH Low_pd_ptr x))); ps_clear x (objBitsKO (the (Low_pdH Low_pd_ptr x))) s0H_internal; kh0H x = Low_pdH Low_pd_ptr x; (a, b) \<in> (case the (Low_pdH Low_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. Low_pdH Low_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 8. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_ptH High_pt_ptr x))); ps_clear x (objBitsKO (the (High_ptH High_pt_ptr x))) s0H_internal; kh0H x = High_ptH High_pt_ptr x; (a, b) \<in> (case the (High_ptH High_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. High_ptH High_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 9. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_ptH Low_pt_ptr x))); ps_clear x (objBitsKO (the (Low_ptH Low_pt_ptr x))) s0H_internal; kh0H x = Low_ptH Low_pt_ptr x; (a, b) \<in> (case the (Low_ptH Low_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. Low_ptH Low_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 10. 1 \<le> maxDomain \<Longrightarrow> if_live_then_nonz_cap' s0H_internal \<and> if_unsafe_then_cap' s0H_internal \<and> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (10 subgoals):
 1. \<lbrakk>1 \<le> maxDomain; ps_clear ntfn_ptr 4 s0H_internal\<rbrakk> \<Longrightarrow> \<exists>v. ksPSpace s0H_internal High_tcb_ptr = Some v \<and> objBitsKO v = 9
 2. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_cte Low_cnode_ptr x))); ps_clear x (objBitsKO (the (Low_cte Low_cnode_ptr x))) s0H_internal; kh0H x = Low_cte Low_cnode_ptr x; (a, b) \<in> (case the (Low_cte Low_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. Low_cte Low_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 3. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_cte High_cnode_ptr x))); ps_clear x (objBitsKO (the (High_cte High_cnode_ptr x))) s0H_internal; kh0H x = High_cte High_cnode_ptr x; (a, b) \<in> (case the (High_cte High_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. High_cte High_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 4. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))); ps_clear x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))) s0H_internal; kh0H x = Silc_cte Silc_cnode_ptr x; (a, b) \<in> (case the (Silc_cte Silc_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. Silc_cte Silc_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 5. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (global_pdH' init_global_pd x))); ps_clear x (objBitsKO (the (global_pdH' init_global_pd x))) s0H_internal; kh0H x = global_pdH' init_global_pd x; (a, b) \<in> (case the (global_pdH' init_global_pd x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range init_global_pd \<and> (\<exists>y. global_pdH' init_global_pd x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 6. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_pdH High_pd_ptr x))); ps_clear x (objBitsKO (the (High_pdH High_pd_ptr x))) s0H_internal; kh0H x = High_pdH High_pd_ptr x; (a, b) \<in> (case the (High_pdH High_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. High_pdH High_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 7. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_pdH Low_pd_ptr x))); ps_clear x (objBitsKO (the (Low_pdH Low_pd_ptr x))) s0H_internal; kh0H x = Low_pdH Low_pd_ptr x; (a, b) \<in> (case the (Low_pdH Low_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. Low_pdH Low_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 8. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_ptH High_pt_ptr x))); ps_clear x (objBitsKO (the (High_ptH High_pt_ptr x))) s0H_internal; kh0H x = High_ptH High_pt_ptr x; (a, b) \<in> (case the (High_ptH High_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. High_ptH High_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 9. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_ptH Low_pt_ptr x))); ps_clear x (objBitsKO (the (Low_ptH Low_pt_ptr x))) s0H_internal; kh0H x = Low_ptH Low_pt_ptr x; (a, b) \<in> (case the (Low_ptH Low_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. Low_ptH Low_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 10. 1 \<le> maxDomain \<Longrightarrow> if_live_then_nonz_cap' s0H_internal \<and> if_unsafe_then_cap' s0H_internal \<and> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (9 subgoals):
 1. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_cte Low_cnode_ptr x))); ps_clear x (objBitsKO (the (Low_cte Low_cnode_ptr x))) s0H_internal; kh0H x = Low_cte Low_cnode_ptr x; (a, b) \<in> (case the (Low_cte Low_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. Low_cte Low_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 2. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_cte High_cnode_ptr x))); ps_clear x (objBitsKO (the (High_cte High_cnode_ptr x))) s0H_internal; kh0H x = High_cte High_cnode_ptr x; (a, b) \<in> (case the (High_cte High_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. High_cte High_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 3. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))); ps_clear x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))) s0H_internal; kh0H x = Silc_cte Silc_cnode_ptr x; (a, b) \<in> (case the (Silc_cte Silc_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. Silc_cte Silc_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 4. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (global_pdH' init_global_pd x))); ps_clear x (objBitsKO (the (global_pdH' init_global_pd x))) s0H_internal; kh0H x = global_pdH' init_global_pd x; (a, b) \<in> (case the (global_pdH' init_global_pd x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range init_global_pd \<and> (\<exists>y. global_pdH' init_global_pd x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 5. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_pdH High_pd_ptr x))); ps_clear x (objBitsKO (the (High_pdH High_pd_ptr x))) s0H_internal; kh0H x = High_pdH High_pd_ptr x; (a, b) \<in> (case the (High_pdH High_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. High_pdH High_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 6. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_pdH Low_pd_ptr x))); ps_clear x (objBitsKO (the (Low_pdH Low_pd_ptr x))) s0H_internal; kh0H x = Low_pdH Low_pd_ptr x; (a, b) \<in> (case the (Low_pdH Low_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. Low_pdH Low_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 7. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_ptH High_pt_ptr x))); ps_clear x (objBitsKO (the (High_ptH High_pt_ptr x))) s0H_internal; kh0H x = High_ptH High_pt_ptr x; (a, b) \<in> (case the (High_ptH High_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. High_ptH High_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 8. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_ptH Low_pt_ptr x))); ps_clear x (objBitsKO (the (Low_ptH Low_pt_ptr x))) s0H_internal; kh0H x = Low_ptH Low_pt_ptr x; (a, b) \<in> (case the (Low_ptH Low_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. Low_ptH Low_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 9. 1 \<le> maxDomain \<Longrightarrow> if_live_then_nonz_cap' s0H_internal \<and> if_unsafe_then_cap' s0H_internal \<and> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (9 subgoals):
 1. \<And>x a b y. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO y); ps_clear x (objBitsKO y) s0H_internal; kh0H x = Some y; (a, b) \<in> (case y of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Low_cnode_ptr; Low_cte Low_cnode_ptr x = Some y\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 2. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_cte High_cnode_ptr x))); ps_clear x (objBitsKO (the (High_cte High_cnode_ptr x))) s0H_internal; kh0H x = High_cte High_cnode_ptr x; (a, b) \<in> (case the (High_cte High_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. High_cte High_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 3. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))); ps_clear x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))) s0H_internal; kh0H x = Silc_cte Silc_cnode_ptr x; (a, b) \<in> (case the (Silc_cte Silc_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. Silc_cte Silc_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 4. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (global_pdH' init_global_pd x))); ps_clear x (objBitsKO (the (global_pdH' init_global_pd x))) s0H_internal; kh0H x = global_pdH' init_global_pd x; (a, b) \<in> (case the (global_pdH' init_global_pd x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range init_global_pd \<and> (\<exists>y. global_pdH' init_global_pd x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 5. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_pdH High_pd_ptr x))); ps_clear x (objBitsKO (the (High_pdH High_pd_ptr x))) s0H_internal; kh0H x = High_pdH High_pd_ptr x; (a, b) \<in> (case the (High_pdH High_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. High_pdH High_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 6. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_pdH Low_pd_ptr x))); ps_clear x (objBitsKO (the (Low_pdH Low_pd_ptr x))) s0H_internal; kh0H x = Low_pdH Low_pd_ptr x; (a, b) \<in> (case the (Low_pdH Low_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. Low_pdH Low_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 7. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_ptH High_pt_ptr x))); ps_clear x (objBitsKO (the (High_ptH High_pt_ptr x))) s0H_internal; kh0H x = High_ptH High_pt_ptr x; (a, b) \<in> (case the (High_ptH High_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. High_ptH High_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 8. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_ptH Low_pt_ptr x))); ps_clear x (objBitsKO (the (Low_ptH Low_pt_ptr x))) s0H_internal; kh0H x = Low_ptH Low_pt_ptr x; (a, b) \<in> (case the (Low_ptH Low_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. Low_ptH Low_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 9. 1 \<le> maxDomain \<Longrightarrow> if_live_then_nonz_cap' s0H_internal \<and> if_unsafe_then_cap' s0H_internal \<and> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (8 subgoals):
 1. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_cte High_cnode_ptr x))); ps_clear x (objBitsKO (the (High_cte High_cnode_ptr x))) s0H_internal; kh0H x = High_cte High_cnode_ptr x; (a, b) \<in> (case the (High_cte High_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. High_cte High_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 2. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))); ps_clear x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))) s0H_internal; kh0H x = Silc_cte Silc_cnode_ptr x; (a, b) \<in> (case the (Silc_cte Silc_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. Silc_cte Silc_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 3. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (global_pdH' init_global_pd x))); ps_clear x (objBitsKO (the (global_pdH' init_global_pd x))) s0H_internal; kh0H x = global_pdH' init_global_pd x; (a, b) \<in> (case the (global_pdH' init_global_pd x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range init_global_pd \<and> (\<exists>y. global_pdH' init_global_pd x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 4. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_pdH High_pd_ptr x))); ps_clear x (objBitsKO (the (High_pdH High_pd_ptr x))) s0H_internal; kh0H x = High_pdH High_pd_ptr x; (a, b) \<in> (case the (High_pdH High_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. High_pdH High_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 5. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_pdH Low_pd_ptr x))); ps_clear x (objBitsKO (the (Low_pdH Low_pd_ptr x))) s0H_internal; kh0H x = Low_pdH Low_pd_ptr x; (a, b) \<in> (case the (Low_pdH Low_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. Low_pdH Low_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 6. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_ptH High_pt_ptr x))); ps_clear x (objBitsKO (the (High_ptH High_pt_ptr x))) s0H_internal; kh0H x = High_ptH High_pt_ptr x; (a, b) \<in> (case the (High_ptH High_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. High_ptH High_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 7. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_ptH Low_pt_ptr x))); ps_clear x (objBitsKO (the (Low_ptH Low_pt_ptr x))) s0H_internal; kh0H x = Low_ptH Low_pt_ptr x; (a, b) \<in> (case the (Low_ptH Low_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. Low_ptH Low_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 8. 1 \<le> maxDomain \<Longrightarrow> if_live_then_nonz_cap' s0H_internal \<and> if_unsafe_then_cap' s0H_internal \<and> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (7 subgoals):
 1. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))); ps_clear x (objBitsKO (the (Silc_cte Silc_cnode_ptr x))) s0H_internal; kh0H x = Silc_cte Silc_cnode_ptr x; (a, b) \<in> (case the (Silc_cte Silc_cnode_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. Silc_cte Silc_cnode_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 2. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (global_pdH' init_global_pd x))); ps_clear x (objBitsKO (the (global_pdH' init_global_pd x))) s0H_internal; kh0H x = global_pdH' init_global_pd x; (a, b) \<in> (case the (global_pdH' init_global_pd x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range init_global_pd \<and> (\<exists>y. global_pdH' init_global_pd x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 3. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_pdH High_pd_ptr x))); ps_clear x (objBitsKO (the (High_pdH High_pd_ptr x))) s0H_internal; kh0H x = High_pdH High_pd_ptr x; (a, b) \<in> (case the (High_pdH High_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. High_pdH High_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 4. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_pdH Low_pd_ptr x))); ps_clear x (objBitsKO (the (Low_pdH Low_pd_ptr x))) s0H_internal; kh0H x = Low_pdH Low_pd_ptr x; (a, b) \<in> (case the (Low_pdH Low_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. Low_pdH Low_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 5. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_ptH High_pt_ptr x))); ps_clear x (objBitsKO (the (High_ptH High_pt_ptr x))) s0H_internal; kh0H x = High_ptH High_pt_ptr x; (a, b) \<in> (case the (High_ptH High_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. High_ptH High_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 6. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_ptH Low_pt_ptr x))); ps_clear x (objBitsKO (the (Low_ptH Low_pt_ptr x))) s0H_internal; kh0H x = Low_ptH Low_pt_ptr x; (a, b) \<in> (case the (Low_ptH Low_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. Low_ptH Low_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 7. 1 \<le> maxDomain \<Longrightarrow> if_live_then_nonz_cap' s0H_internal \<and> if_unsafe_then_cap' s0H_internal \<and> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (6 subgoals):
 1. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (global_pdH' init_global_pd x))); ps_clear x (objBitsKO (the (global_pdH' init_global_pd x))) s0H_internal; kh0H x = global_pdH' init_global_pd x; (a, b) \<in> (case the (global_pdH' init_global_pd x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range init_global_pd \<and> (\<exists>y. global_pdH' init_global_pd x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 2. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_pdH High_pd_ptr x))); ps_clear x (objBitsKO (the (High_pdH High_pd_ptr x))) s0H_internal; kh0H x = High_pdH High_pd_ptr x; (a, b) \<in> (case the (High_pdH High_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. High_pdH High_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 3. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_pdH Low_pd_ptr x))); ps_clear x (objBitsKO (the (Low_pdH Low_pd_ptr x))) s0H_internal; kh0H x = Low_pdH Low_pd_ptr x; (a, b) \<in> (case the (Low_pdH Low_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. Low_pdH Low_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 4. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_ptH High_pt_ptr x))); ps_clear x (objBitsKO (the (High_ptH High_pt_ptr x))) s0H_internal; kh0H x = High_ptH High_pt_ptr x; (a, b) \<in> (case the (High_ptH High_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. High_ptH High_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 5. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_ptH Low_pt_ptr x))); ps_clear x (objBitsKO (the (Low_ptH Low_pt_ptr x))) s0H_internal; kh0H x = Low_ptH Low_pt_ptr x; (a, b) \<in> (case the (Low_ptH Low_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. Low_ptH Low_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 6. 1 \<le> maxDomain \<Longrightarrow> if_live_then_nonz_cap' s0H_internal \<and> if_unsafe_then_cap' s0H_internal \<and> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_pdH High_pd_ptr x))); ps_clear x (objBitsKO (the (High_pdH High_pd_ptr x))) s0H_internal; kh0H x = High_pdH High_pd_ptr x; (a, b) \<in> (case the (High_pdH High_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. High_pdH High_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 2. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_pdH Low_pd_ptr x))); ps_clear x (objBitsKO (the (Low_pdH Low_pd_ptr x))) s0H_internal; kh0H x = Low_pdH Low_pd_ptr x; (a, b) \<in> (case the (Low_pdH Low_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. Low_pdH Low_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 3. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_ptH High_pt_ptr x))); ps_clear x (objBitsKO (the (High_ptH High_pt_ptr x))) s0H_internal; kh0H x = High_ptH High_pt_ptr x; (a, b) \<in> (case the (High_ptH High_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. High_ptH High_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 4. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_ptH Low_pt_ptr x))); ps_clear x (objBitsKO (the (Low_ptH Low_pt_ptr x))) s0H_internal; kh0H x = Low_ptH Low_pt_ptr x; (a, b) \<in> (case the (Low_ptH Low_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. Low_ptH Low_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 5. 1 \<le> maxDomain \<Longrightarrow> if_live_then_nonz_cap' s0H_internal \<and> if_unsafe_then_cap' s0H_internal \<and> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (4 subgoals):
 1. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_pdH Low_pd_ptr x))); ps_clear x (objBitsKO (the (Low_pdH Low_pd_ptr x))) s0H_internal; kh0H x = Low_pdH Low_pd_ptr x; (a, b) \<in> (case the (Low_pdH Low_pd_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. Low_pdH Low_pd_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 2. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_ptH High_pt_ptr x))); ps_clear x (objBitsKO (the (High_ptH High_pt_ptr x))) s0H_internal; kh0H x = High_ptH High_pt_ptr x; (a, b) \<in> (case the (High_ptH High_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. High_ptH High_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 3. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_ptH Low_pt_ptr x))); ps_clear x (objBitsKO (the (Low_ptH Low_pt_ptr x))) s0H_internal; kh0H x = Low_ptH Low_pt_ptr x; (a, b) \<in> (case the (Low_ptH Low_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. Low_ptH Low_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 4. 1 \<le> maxDomain \<Longrightarrow> if_live_then_nonz_cap' s0H_internal \<and> if_unsafe_then_cap' s0H_internal \<and> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (3 subgoals):
 1. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (High_ptH High_pt_ptr x))); ps_clear x (objBitsKO (the (High_ptH High_pt_ptr x))) s0H_internal; kh0H x = High_ptH High_pt_ptr x; (a, b) \<in> (case the (High_ptH High_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. High_ptH High_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 2. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_ptH Low_pt_ptr x))); ps_clear x (objBitsKO (the (Low_ptH Low_pt_ptr x))) s0H_internal; kh0H x = Low_ptH Low_pt_ptr x; (a, b) \<in> (case the (Low_ptH Low_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. Low_ptH Low_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 3. 1 \<le> maxDomain \<Longrightarrow> if_live_then_nonz_cap' s0H_internal \<and> if_unsafe_then_cap' s0H_internal \<and> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. \<And>x a b. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (Low_ptH Low_pt_ptr x))); ps_clear x (objBitsKO (the (Low_ptH Low_pt_ptr x))) s0H_internal; kh0H x = Low_ptH Low_pt_ptr x; (a, b) \<in> (case the (Low_ptH Low_pt_ptr x) of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {}); x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. Low_ptH Low_pt_ptr x = Some y)\<rbrakk> \<Longrightarrow> (\<exists>y. kh0H a = Some y) \<and> (\<forall>x2. (is_aligned a (objBitsKO x2) \<and> ps_clear a (objBitsKO x2) s0H_internal \<longrightarrow> kh0H a = Some x2 \<longrightarrow> (x, symreftype b) \<in> (case x2 of KOEndpoint x \<Rightarrow> ep_q_refs_of' x | KONotification ntfn \<Rightarrow> ntfn_q_refs_of' (ntfnObj ntfn) \<union> ntfn_bound_refs' (ntfnBoundTCB ntfn) | KOTCB tcb \<Rightarrow> tcb_st_refs_of' (tcbState tcb) \<union> tcb_bound_refs' (tcbBoundNotification tcb) | KOCTE x \<Rightarrow> scheduler_affects_globals_frame x | KOArch x \<Rightarrow> scheduler_affects_globals_frame x | _ \<Rightarrow> {})) \<and> ((is_aligned a (objBitsKO x2) \<longrightarrow> \<not> ps_clear a (objBitsKO x2) s0H_internal) \<longrightarrow> kh0H a \<noteq> Some x2))
 2. 1 \<le> maxDomain \<Longrightarrow> if_live_then_nonz_cap' s0H_internal \<and> if_unsafe_then_cap' s0H_internal \<and> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> if_live_then_nonz_cap' s0H_internal \<and> if_unsafe_then_cap' s0H_internal \<and> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> if_live_then_nonz_cap' s0H_internal
 2. 1 \<le> maxDomain \<Longrightarrow> if_unsafe_then_cap' s0H_internal \<and> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. \<And>ptr ko. \<lbrakk>1 \<le> maxDomain; kh0H ptr = Some ko; is_aligned ptr (objBitsKO ko); live' ko; ps_clear ptr (objBitsKO ko) s0H_internal\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 2. 1 \<le> maxDomain \<Longrightarrow> if_unsafe_then_cap' s0H_internal \<and> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. \<And>ptr ko. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (objBitsKO ko); live' ko; ps_clear ptr (objBitsKO ko) s0H_internal; ptr = init_globals_frame \<and> ko = KOUserData \<or> ptr = idle_tcb_ptr \<and> ko = KOTCB idle_tcbH \<or> ptr = High_tcb_ptr \<and> ko = KOTCB High_tcbH \<or> ptr = Low_tcb_ptr \<and> ko = KOTCB Low_tcbH \<or> ptr = ntfn_ptr \<and> ko = KONotification ntfnH \<or> ptr = irq_cnode_ptr \<and> ko = KOCTE irq_cte \<or> ptr \<in> irq_node_offs_range \<and> ko = KOCTE (CTE capability.NullCap (MDB 0 0 False False)) \<or> ptr \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr ptr \<noteq> None \<and> ko = the (Low_cte Low_cnode_ptr ptr) \<or> ptr \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr ptr \<noteq> None \<and> ko = the (High_cte High_cnode_ptr ptr) \<or> ptr \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr ptr \<noteq> None \<and> ko = the (Silc_cte Silc_cnode_ptr ptr) \<or> ptr \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd ptr \<noteq> None \<and> ko = the (global_pdH' init_global_pd ptr) \<or> ptr \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr ptr \<noteq> None \<and> ko = the (High_pdH High_pd_ptr ptr) \<or> ptr \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr ptr \<noteq> None \<and> ko = the (Low_pdH Low_pd_ptr ptr) \<or> ptr \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr ptr \<noteq> None \<and> ko = the (High_ptH High_pt_ptr ptr) \<or> ptr \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr ptr \<noteq> None \<and> ko = the (Low_ptH Low_pt_ptr ptr)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 2. 1 \<le> maxDomain \<Longrightarrow> if_unsafe_then_cap' s0H_internal \<and> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (12 subgoals):
 1. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned High_tcb_ptr 9; ps_clear High_tcb_ptr 9 s0H_internal; ptr = High_tcb_ptr\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' High_tcb_ptr s0H_internal
 2. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned Low_tcb_ptr 9; ps_clear Low_tcb_ptr 9 s0H_internal; ptr = Low_tcb_ptr\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' Low_tcb_ptr s0H_internal
 3. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ntfn_ptr 4; ps_clear ntfn_ptr 4 s0H_internal; ptr = ntfn_ptr\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ntfn_ptr s0H_internal
 4. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None)); ps_clear ptr (case the (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 5. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None)); ps_clear ptr (case the (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 6. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None)); ps_clear ptr (case the (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 7. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPDE (if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pd_offs_range init_global_pd \<and> (\<exists>y. (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 8. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (High_pd'H x))) (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPDE (High_pd'H x))) (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (High_pd'H x))) (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 9. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (Low_pd'H x))) (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPDE (Low_pd'H x))) (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (Low_pd'H x))) (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 10. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<lbrakk>1 \<le> maxDomain; is_aligned High_tcb_ptr 9; ps_clear High_tcb_ptr 9 s0H_internal\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> High_tcb_ptr \<in> zobj_refs' (cteCap cte)
 2. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned Low_tcb_ptr 9; ps_clear Low_tcb_ptr 9 s0H_internal; ptr = Low_tcb_ptr\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' Low_tcb_ptr s0H_internal
 3. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ntfn_ptr 4; ps_clear ntfn_ptr 4 s0H_internal; ptr = ntfn_ptr\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ntfn_ptr s0H_internal
 4. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None)); ps_clear ptr (case the (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 5. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None)); ps_clear ptr (case the (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 6. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None)); ps_clear ptr (case the (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 7. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPDE (if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pd_offs_range init_global_pd \<and> (\<exists>y. (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 8. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (High_pd'H x))) (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPDE (High_pd'H x))) (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (High_pd'H x))) (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 9. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (Low_pd'H x))) (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPDE (Low_pd'H x))) (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (Low_pd'H x))) (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 10. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<lbrakk>1 \<le> maxDomain; is_aligned High_tcb_ptr 9; ps_clear High_tcb_ptr 9 s0H_internal\<rbrakk> \<Longrightarrow> \<exists>cte. map_to_ctes kh0H (High_cnode_ptr + 0x10) = Some cte \<and> High_tcb_ptr \<in> zobj_refs' (cteCap cte)
 2. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned Low_tcb_ptr 9; ps_clear Low_tcb_ptr 9 s0H_internal; ptr = Low_tcb_ptr\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' Low_tcb_ptr s0H_internal
 3. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ntfn_ptr 4; ps_clear ntfn_ptr 4 s0H_internal; ptr = ntfn_ptr\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ntfn_ptr s0H_internal
 4. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None)); ps_clear ptr (case the (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 5. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None)); ps_clear ptr (case the (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 6. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None)); ps_clear ptr (case the (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 7. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPDE (if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pd_offs_range init_global_pd \<and> (\<exists>y. (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 8. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (High_pd'H x))) (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPDE (High_pd'H x))) (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (High_pd'H x))) (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 9. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (Low_pd'H x))) (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPDE (Low_pd'H x))) (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (Low_pd'H x))) (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 10. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned Low_tcb_ptr 9; ps_clear Low_tcb_ptr 9 s0H_internal; ptr = Low_tcb_ptr\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' Low_tcb_ptr s0H_internal
 2. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ntfn_ptr 4; ps_clear ntfn_ptr 4 s0H_internal; ptr = ntfn_ptr\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ntfn_ptr s0H_internal
 3. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None)); ps_clear ptr (case the (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 4. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None)); ps_clear ptr (case the (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 5. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None)); ps_clear ptr (case the (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 6. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPDE (if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pd_offs_range init_global_pd \<and> (\<exists>y. (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 7. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (High_pd'H x))) (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPDE (High_pd'H x))) (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (High_pd'H x))) (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 8. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (Low_pd'H x))) (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPDE (Low_pd'H x))) (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (Low_pd'H x))) (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 9. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 10. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned ptr 2 \<and> Low_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - Low_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned ptr 2 \<and> Low_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - Low_pt_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned ptr 2 \<and> Low_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - Low_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> Low_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - Low_pt_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<lbrakk>1 \<le> maxDomain; is_aligned Low_tcb_ptr 9; ps_clear Low_tcb_ptr 9 s0H_internal\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> Low_tcb_ptr \<in> zobj_refs' (cteCap cte)
 2. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ntfn_ptr 4; ps_clear ntfn_ptr 4 s0H_internal; ptr = ntfn_ptr\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ntfn_ptr s0H_internal
 3. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None)); ps_clear ptr (case the (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 4. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None)); ps_clear ptr (case the (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 5. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None)); ps_clear ptr (case the (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 6. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPDE (if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pd_offs_range init_global_pd \<and> (\<exists>y. (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 7. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (High_pd'H x))) (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPDE (High_pd'H x))) (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (High_pd'H x))) (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 8. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (Low_pd'H x))) (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPDE (Low_pd'H x))) (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (Low_pd'H x))) (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 9. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 10. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned ptr 2 \<and> Low_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - Low_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned ptr 2 \<and> Low_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - Low_pt_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned ptr 2 \<and> Low_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - Low_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> Low_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - Low_pt_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<lbrakk>1 \<le> maxDomain; is_aligned Low_tcb_ptr 9; ps_clear Low_tcb_ptr 9 s0H_internal\<rbrakk> \<Longrightarrow> \<exists>cte. map_to_ctes kh0H (Low_cnode_ptr + 0x10) = Some cte \<and> Low_tcb_ptr \<in> zobj_refs' (cteCap cte)
 2. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ntfn_ptr 4; ps_clear ntfn_ptr 4 s0H_internal; ptr = ntfn_ptr\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ntfn_ptr s0H_internal
 3. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None)); ps_clear ptr (case the (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 4. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None)); ps_clear ptr (case the (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 5. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None)); ps_clear ptr (case the (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 6. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPDE (if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pd_offs_range init_global_pd \<and> (\<exists>y. (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 7. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (High_pd'H x))) (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPDE (High_pd'H x))) (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (High_pd'H x))) (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 8. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (Low_pd'H x))) (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPDE (Low_pd'H x))) (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (Low_pd'H x))) (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 9. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 10. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned ptr 2 \<and> Low_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - Low_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned ptr 2 \<and> Low_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - Low_pt_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned ptr 2 \<and> Low_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - Low_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> Low_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - Low_pt_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ntfn_ptr 4; ps_clear ntfn_ptr 4 s0H_internal; ptr = ntfn_ptr\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ntfn_ptr s0H_internal
 2. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None)); ps_clear ptr (case the (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 3. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None)); ps_clear ptr (case the (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 4. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None)); ps_clear ptr (case the (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 5. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPDE (if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pd_offs_range init_global_pd \<and> (\<exists>y. (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 6. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (High_pd'H x))) (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPDE (High_pd'H x))) (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (High_pd'H x))) (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 7. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (Low_pd'H x))) (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPDE (Low_pd'H x))) (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (Low_pd'H x))) (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 8. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 9. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned ptr 2 \<and> Low_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - Low_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned ptr 2 \<and> Low_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - Low_pt_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned ptr 2 \<and> Low_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - Low_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> Low_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - Low_pt_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> if_unsafe_then_cap' s0H_internal \<and> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (10 subgoals):
 1. \<lbrakk>1 \<le> maxDomain; is_aligned ntfn_ptr 4; ps_clear ntfn_ptr 4 s0H_internal\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> ntfn_ptr \<in> zobj_refs' (cteCap cte)
 2. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None)); ps_clear ptr (case the (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 3. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None)); ps_clear ptr (case the (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 4. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None)); ps_clear ptr (case the (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 5. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPDE (if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pd_offs_range init_global_pd \<and> (\<exists>y. (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 6. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (High_pd'H x))) (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPDE (High_pd'H x))) (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (High_pd'H x))) (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 7. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (Low_pd'H x))) (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPDE (Low_pd'H x))) (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (Low_pd'H x))) (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 8. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 9. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned ptr 2 \<and> Low_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - Low_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned ptr 2 \<and> Low_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - Low_pt_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned ptr 2 \<and> Low_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - Low_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> Low_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - Low_pt_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> if_unsafe_then_cap' s0H_internal \<and> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (10 subgoals):
 1. \<lbrakk>1 \<le> maxDomain; is_aligned ntfn_ptr 4; ps_clear ntfn_ptr 4 s0H_internal\<rbrakk> \<Longrightarrow> \<exists>cte. map_to_ctes kh0H (Silc_cnode_ptr + 0x13E0) = Some cte \<and> ntfn_ptr \<in> zobj_refs' (cteCap cte)
 2. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None)); ps_clear ptr (case the (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 3. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None)); ps_clear ptr (case the (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 4. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None)); ps_clear ptr (case the (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 5. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPDE (if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pd_offs_range init_global_pd \<and> (\<exists>y. (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 6. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (High_pd'H x))) (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPDE (High_pd'H x))) (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (High_pd'H x))) (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 7. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (Low_pd'H x))) (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPDE (Low_pd'H x))) (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (Low_pd'H x))) (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 8. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 9. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned ptr 2 \<and> Low_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - Low_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned ptr 2 \<and> Low_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - Low_pt_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned ptr 2 \<and> Low_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - Low_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> Low_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - Low_pt_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 10. 1 \<le> maxDomain \<Longrightarrow> if_unsafe_then_cap' s0H_internal \<and> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (9 subgoals):
 1. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None)); ps_clear ptr (case the (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 2. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None)); ps_clear ptr (case the (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 3. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None)); ps_clear ptr (case the (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 4. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPDE (if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pd_offs_range init_global_pd \<and> (\<exists>y. (if is_aligned ptr 2 \<and> init_global_pd \<le> ptr \<and> ptr \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (ptr - init_global_pd >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 5. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (High_pd'H x))) (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPDE (High_pd'H x))) (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (High_pd'H x))) (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> High_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - High_pd_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 6. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (Low_pd'H x))) (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPDE (Low_pd'H x))) (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPDE (Low_pd'H x))) (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> Low_pd_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (ptr - Low_pd_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 7. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> High_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - High_pt_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 8. \<And>ptr. \<lbrakk>1 \<le> maxDomain; is_aligned ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned ptr 2 \<and> Low_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - Low_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); live' (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned ptr 2 \<and> Low_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - Low_pt_ptr >> 2)) else None))); ps_clear ptr (case the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned ptr 2 \<and> Low_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - Low_pt_ptr >> 2)) else None)) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal; ptr \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned ptr 2 \<and> Low_pt_ptr \<le> ptr \<and> ptr \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (ptr - Low_pt_ptr >> 2)) else None) = Some y)\<rbrakk> \<Longrightarrow> ex_nonz_cap_to' ptr s0H_internal
 9. 1 \<le> maxDomain \<Longrightarrow> if_unsafe_then_cap' s0H_internal \<and> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> if_unsafe_then_cap' s0H_internal \<and> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> if_unsafe_then_cap' s0H_internal
 2. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. \<And>cref cte. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = Some cte; cteCap cte \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 2. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. \<And>cref cte. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = Some cte; cteCap cte \<noteq> capability.NullCap; cref = idle_tcb_ptr \<and> cte = CTE capability.NullCap (MDB 0 0 False False) \<or> cref = idle_tcb_ptr + 0x10 \<and> cte = CTE capability.NullCap (MDB 0 0 False False) \<or> cref = idle_tcb_ptr + 0x20 \<and> cte = CTE capability.NullCap (MDB 0 0 False False) \<or> cref = idle_tcb_ptr + 0x30 \<and> cte = CTE capability.NullCap (MDB 0 0 False False) \<or> cref = idle_tcb_ptr + 0x40 \<and> cte = CTE capability.NullCap (MDB 0 0 False False) \<or> cref = Low_tcb_ptr \<and> cte = CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB (Low_cnode_ptr + 0x20) 0 False False) \<or> cref = Low_tcb_ptr + 0x10 \<and> cte = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False) \<or> cref = Low_tcb_ptr + 0x20 \<and> cte = CTE (capability.ReplyCap Low_tcb_ptr True True) (MDB 0 0 True True) \<or> cref = Low_tcb_ptr + 0x30 \<and> cte = CTE capability.NullCap (MDB 0 0 False False) \<or> cref = Low_tcb_ptr + 0x40 \<and> cte = CTE capability.NullCap (MDB 0 0 False False) \<or> cref = High_tcb_ptr \<and> cte = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False) \<or> cref = High_tcb_ptr + 0x10 \<and> cte = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False) \<or> cref = High_tcb_ptr + 0x20 \<and> cte = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True) \<or> cref = High_tcb_ptr + 0x30 \<and> cte = CTE capability.NullCap (MDB 0 0 False False) \<or> cref = High_tcb_ptr + 0x40 \<and> cte = CTE capability.NullCap (MDB 0 0 False False) \<or> cref = irq_cnode_ptr \<and> cte = CTE capability.NullCap (MDB 0 0 False False) \<or> cref \<in> irq_node_offs_range \<and> cte = CTE capability.NullCap (MDB 0 0 False False) \<or> cref \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte_cte Silc_cnode_ptr cref \<noteq> None \<and> cte = the (Silc_cte_cte Silc_cnode_ptr cref) \<or> cref \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr cref \<noteq> None \<and> cte = the (High_cte_cte High_cnode_ptr cref) \<or> cref \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr cref \<noteq> None \<and> cte = the (Low_cte_cte Low_cnode_ptr cref)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 2. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (10 subgoals):
 1. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = Low_tcb_ptr\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> Low_tcb_ptr \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 2. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = Low_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> Low_tcb_ptr + 0x10 \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 3. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = Low_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> Low_tcb_ptr + 0x20 \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 4. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = High_tcb_ptr\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> High_tcb_ptr \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 5. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = High_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> High_tcb_ptr + 0x10 \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 6. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = High_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> High_tcb_ptr + 0x20 \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 7. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 8. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 9. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 10. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (10 subgoals):
 1. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = Low_tcb_ptr\<rbrakk> \<Longrightarrow> \<exists>cte. map_to_ctes kh0H (Low_cnode_ptr + 0x10) = Some cte \<and> Low_tcb_ptr \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 2. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = Low_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> Low_tcb_ptr + 0x10 \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 3. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = Low_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> Low_tcb_ptr + 0x20 \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 4. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = High_tcb_ptr\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> High_tcb_ptr \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 5. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = High_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> High_tcb_ptr + 0x10 \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 6. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = High_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> High_tcb_ptr + 0x20 \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 7. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 8. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 9. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 10. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (9 subgoals):
 1. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = Low_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> Low_tcb_ptr + 0x10 \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 2. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = Low_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> Low_tcb_ptr + 0x20 \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 3. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = High_tcb_ptr\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> High_tcb_ptr \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 4. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = High_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> High_tcb_ptr + 0x10 \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 5. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = High_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> High_tcb_ptr + 0x20 \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 6. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 7. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 8. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 9. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (9 subgoals):
 1. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = Low_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> \<exists>cte. map_to_ctes kh0H (Low_cnode_ptr + 0x10) = Some cte \<and> Low_tcb_ptr + 0x10 \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 2. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = Low_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> Low_tcb_ptr + 0x20 \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 3. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = High_tcb_ptr\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> High_tcb_ptr \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 4. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = High_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> High_tcb_ptr + 0x10 \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 5. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = High_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> High_tcb_ptr + 0x20 \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 6. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 7. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 8. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 9. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (8 subgoals):
 1. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = Low_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> Low_tcb_ptr + 0x20 \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 2. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = High_tcb_ptr\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> High_tcb_ptr \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 3. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = High_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> High_tcb_ptr + 0x10 \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 4. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = High_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> High_tcb_ptr + 0x20 \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 5. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 6. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 7. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 8. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (8 subgoals):
 1. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = Low_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> \<exists>cte. map_to_ctes kh0H (Low_cnode_ptr + 0x10) = Some cte \<and> Low_tcb_ptr + 0x20 \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 2. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = High_tcb_ptr\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> High_tcb_ptr \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 3. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = High_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> High_tcb_ptr + 0x10 \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 4. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = High_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> High_tcb_ptr + 0x20 \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 5. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 6. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 7. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 8. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (7 subgoals):
 1. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = High_tcb_ptr\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> High_tcb_ptr \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 2. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = High_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> High_tcb_ptr + 0x10 \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 3. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = High_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> High_tcb_ptr + 0x20 \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 4. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 5. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 6. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 7. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (7 subgoals):
 1. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = High_tcb_ptr\<rbrakk> \<Longrightarrow> \<exists>cte. map_to_ctes kh0H (High_cnode_ptr + 0x10) = Some cte \<and> High_tcb_ptr \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 2. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = High_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> High_tcb_ptr + 0x10 \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 3. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = High_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> High_tcb_ptr + 0x20 \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 4. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 5. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 6. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 7. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (6 subgoals):
 1. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = High_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> High_tcb_ptr + 0x10 \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 2. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = High_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> High_tcb_ptr + 0x20 \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 3. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 4. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 5. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 6. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (6 subgoals):
 1. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = High_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> \<exists>cte. map_to_ctes kh0H (High_cnode_ptr + 0x10) = Some cte \<and> High_tcb_ptr + 0x10 \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 2. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = High_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> High_tcb_ptr + 0x20 \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 3. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 4. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 5. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 6. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = High_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> \<exists>cref cte. map_to_ctes kh0H cref = Some cte \<and> High_tcb_ptr + 0x20 \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 2. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 3. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 4. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 5. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>cref. \<lbrakk>1 \<le> maxDomain; cref = High_tcb_ptr + 0x20\<rbrakk> \<Longrightarrow> \<exists>cte. map_to_ctes kh0H (High_cnode_ptr + 0x10) = Some cte \<and> High_tcb_ptr + 0x20 \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 2. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 3. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 4. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 5. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (4 subgoals):
 1. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 2. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 3. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 4. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (4 subgoals):
 1. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Silc_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>cte. map_to_ctes kh0H (Silc_cnode_ptr + 0x20) = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 2. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 3. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 4. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Silc_cnode_ptr; is_aligned cref 4; Silc_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Silc_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> 4) = 0x13E\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Silc_cnode_ptr + x * 0x10
 2. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Silc_cnode_ptr; is_aligned cref 4; Silc_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Silc_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> 4) = 2\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Silc_cnode_ptr + x * 0x10
 3. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 4. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 5. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Silc_cnode_ptr; is_aligned cref 4; Silc_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Silc_cnode_ptr; cref = Silc_cnode_ptr + 0x13E0\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Silc_cnode_ptr + x * 0x10
 2. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Silc_cnode_ptr; is_aligned cref 4; Silc_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Silc_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> 4) = 2\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Silc_cnode_ptr + x * 0x10
 3. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 4. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 5. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (6 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Silc_cnode_ptr; is_aligned cref 4; Silc_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Silc_cnode_ptr; cref = Silc_cnode_ptr + 0x13E0\<rbrakk> \<Longrightarrow> cref = Silc_cnode_ptr + 0x13E * 0x10
 2. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Silc_cnode_ptr; is_aligned cref 4; Silc_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Silc_cnode_ptr; cref = Silc_cnode_ptr + 0x13E0\<rbrakk> \<Longrightarrow> 0x13E \<in> {0..0x3FF}
 3. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Silc_cnode_ptr; is_aligned cref 4; Silc_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Silc_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> 4) = 2\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Silc_cnode_ptr + x * 0x10
 4. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 5. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 6. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Silc_cnode_ptr; is_aligned cref 4; Silc_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Silc_cnode_ptr; cref = Silc_cnode_ptr + 0x13E0\<rbrakk> \<Longrightarrow> 0x13E \<in> {0..0x3FF}
 2. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Silc_cnode_ptr; is_aligned cref 4; Silc_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Silc_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> 4) = 2\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Silc_cnode_ptr + x * 0x10
 3. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 4. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 5. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (4 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Silc_cnode_ptr; is_aligned cref 4; Silc_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Silc_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Silc_cnode_ptr >> 4) = 2\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Silc_cnode_ptr + x * 0x10
 2. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 3. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 4. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (4 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Silc_cnode_ptr; is_aligned cref 4; Silc_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Silc_cnode_ptr; cref = Silc_cnode_ptr + 0x20\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Silc_cnode_ptr + x * 0x10
 2. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 3. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 4. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Silc_cnode_ptr; is_aligned cref 4; Silc_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Silc_cnode_ptr; cref = Silc_cnode_ptr + 0x20\<rbrakk> \<Longrightarrow> cref = Silc_cnode_ptr + 2 * 0x10
 2. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Silc_cnode_ptr; is_aligned cref 4; Silc_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Silc_cnode_ptr; cref = Silc_cnode_ptr + 0x20\<rbrakk> \<Longrightarrow> 2 \<in> {0..0x3FF}
 3. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 4. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 5. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (4 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Silc_cnode_ptr; is_aligned cref 4; Silc_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Silc_cnode_ptr; cref = Silc_cnode_ptr + 0x20\<rbrakk> \<Longrightarrow> 2 \<in> {0..0x3FF}
 2. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 3. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 4. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (3 subgoals):
 1. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 2. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 3. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (3 subgoals):
 1. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> High_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>cte. map_to_ctes kh0H (High_cnode_ptr + 0x20) = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 2. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 3. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (6 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> 4) = 0x13E\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = High_cnode_ptr + x * 0x10
 2. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> 4) = 3\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = High_cnode_ptr + x * 0x10
 3. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> 4) = 2\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = High_cnode_ptr + x * 0x10
 4. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> 4) = 1\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = High_cnode_ptr + x * 0x10
 5. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 6. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (6 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; cref = High_cnode_ptr + 0x13E0\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = High_cnode_ptr + x * 0x10
 2. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> 4) = 3\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = High_cnode_ptr + x * 0x10
 3. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> 4) = 2\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = High_cnode_ptr + x * 0x10
 4. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> 4) = 1\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = High_cnode_ptr + x * 0x10
 5. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 6. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (7 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; cref = High_cnode_ptr + 0x13E0\<rbrakk> \<Longrightarrow> cref = High_cnode_ptr + 0x13E * 0x10
 2. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; cref = High_cnode_ptr + 0x13E0\<rbrakk> \<Longrightarrow> 0x13E \<in> {0..0x3FF}
 3. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> 4) = 3\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = High_cnode_ptr + x * 0x10
 4. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> 4) = 2\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = High_cnode_ptr + x * 0x10
 5. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> 4) = 1\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = High_cnode_ptr + x * 0x10
 6. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 7. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (6 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; cref = High_cnode_ptr + 0x13E0\<rbrakk> \<Longrightarrow> 0x13E \<in> {0..0x3FF}
 2. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> 4) = 3\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = High_cnode_ptr + x * 0x10
 3. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> 4) = 2\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = High_cnode_ptr + x * 0x10
 4. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> 4) = 1\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = High_cnode_ptr + x * 0x10
 5. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 6. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> 4) = 3\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = High_cnode_ptr + x * 0x10
 2. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> 4) = 2\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = High_cnode_ptr + x * 0x10
 3. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> 4) = 1\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = High_cnode_ptr + x * 0x10
 4. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 5. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; cref = High_cnode_ptr + 0x30\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = High_cnode_ptr + x * 0x10
 2. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> 4) = 2\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = High_cnode_ptr + x * 0x10
 3. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> 4) = 1\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = High_cnode_ptr + x * 0x10
 4. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 5. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (6 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; cref = High_cnode_ptr + 0x30\<rbrakk> \<Longrightarrow> cref = High_cnode_ptr + 3 * 0x10
 2. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; cref = High_cnode_ptr + 0x30\<rbrakk> \<Longrightarrow> 3 \<in> {0..0x3FF}
 3. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> 4) = 2\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = High_cnode_ptr + x * 0x10
 4. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> 4) = 1\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = High_cnode_ptr + x * 0x10
 5. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 6. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; cref = High_cnode_ptr + 0x30\<rbrakk> \<Longrightarrow> 3 \<in> {0..0x3FF}
 2. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> 4) = 2\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = High_cnode_ptr + x * 0x10
 3. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> 4) = 1\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = High_cnode_ptr + x * 0x10
 4. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 5. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (4 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> 4) = 2\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = High_cnode_ptr + x * 0x10
 2. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> 4) = 1\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = High_cnode_ptr + x * 0x10
 3. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 4. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (4 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; cref = High_cnode_ptr + 0x20\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = High_cnode_ptr + x * 0x10
 2. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> 4) = 1\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = High_cnode_ptr + x * 0x10
 3. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 4. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; cref = High_cnode_ptr + 0x20\<rbrakk> \<Longrightarrow> cref = High_cnode_ptr + 2 * 0x10
 2. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; cref = High_cnode_ptr + 0x20\<rbrakk> \<Longrightarrow> 2 \<in> {0..0x3FF}
 3. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> 4) = 1\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = High_cnode_ptr + x * 0x10
 4. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 5. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (4 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; cref = High_cnode_ptr + 0x20\<rbrakk> \<Longrightarrow> 2 \<in> {0..0x3FF}
 2. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> 4) = 1\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = High_cnode_ptr + x * 0x10
 3. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 4. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (3 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - High_cnode_ptr >> 4) = 1\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = High_cnode_ptr + x * 0x10
 2. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 3. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (3 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; cref = High_cnode_ptr + 0x10\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = High_cnode_ptr + x * 0x10
 2. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 3. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (4 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; cref = High_cnode_ptr + 0x10\<rbrakk> \<Longrightarrow> cref = High_cnode_ptr + 1 * 0x10
 2. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; cref = High_cnode_ptr + 0x10\<rbrakk> \<Longrightarrow> 1 \<in> {0..0x3FF}
 3. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 4. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (3 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range High_cnode_ptr; is_aligned cref 4; High_cnode_ptr \<le> cref; cref \<le> 0x3FFF + High_cnode_ptr; cref = High_cnode_ptr + 0x10\<rbrakk> \<Longrightarrow> 1 \<in> {0..0x3FF}
 2. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 3. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>crefa cte. map_to_ctes kh0H crefa = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 2. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. \<And>cref. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H cref = (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); cteCap (the (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) \<noteq> capability.NullCap; cref \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned cref cte_level_bits \<and> Low_cnode_ptr \<le> cref \<and> cref \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> \<exists>cte. map_to_ctes kh0H (Low_cnode_ptr + 0x20) = Some cte \<and> cref \<in> cte_refs' (cteCap cte) (irq_node' s0H_internal)
 2. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> 4) = 0x13E\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Low_cnode_ptr + x * 0x10
 2. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> 4) = 3\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Low_cnode_ptr + x * 0x10
 3. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> 4) = 2\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Low_cnode_ptr + x * 0x10
 4. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> 4) = 1\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Low_cnode_ptr + x * 0x10
 5. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; cref = Low_cnode_ptr + 0x13E0\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Low_cnode_ptr + x * 0x10
 2. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> 4) = 3\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Low_cnode_ptr + x * 0x10
 3. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> 4) = 2\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Low_cnode_ptr + x * 0x10
 4. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> 4) = 1\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Low_cnode_ptr + x * 0x10
 5. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (6 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; cref = Low_cnode_ptr + 0x13E0\<rbrakk> \<Longrightarrow> cref = Low_cnode_ptr + 0x13E * 0x10
 2. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; cref = Low_cnode_ptr + 0x13E0\<rbrakk> \<Longrightarrow> 0x13E \<in> {0..0x3FF}
 3. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> 4) = 3\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Low_cnode_ptr + x * 0x10
 4. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> 4) = 2\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Low_cnode_ptr + x * 0x10
 5. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> 4) = 1\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Low_cnode_ptr + x * 0x10
 6. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; cref = Low_cnode_ptr + 0x13E0\<rbrakk> \<Longrightarrow> 0x13E \<in> {0..0x3FF}
 2. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> 4) = 3\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Low_cnode_ptr + x * 0x10
 3. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> 4) = 2\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Low_cnode_ptr + x * 0x10
 4. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> 4) = 1\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Low_cnode_ptr + x * 0x10
 5. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (4 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> 4) = 3\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Low_cnode_ptr + x * 0x10
 2. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> 4) = 2\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Low_cnode_ptr + x * 0x10
 3. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> 4) = 1\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Low_cnode_ptr + x * 0x10
 4. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (4 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; cref = Low_cnode_ptr + 0x30\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Low_cnode_ptr + x * 0x10
 2. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> 4) = 2\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Low_cnode_ptr + x * 0x10
 3. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> 4) = 1\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Low_cnode_ptr + x * 0x10
 4. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; cref = Low_cnode_ptr + 0x30\<rbrakk> \<Longrightarrow> cref = Low_cnode_ptr + 3 * 0x10
 2. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; cref = Low_cnode_ptr + 0x30\<rbrakk> \<Longrightarrow> 3 \<in> {0..0x3FF}
 3. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> 4) = 2\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Low_cnode_ptr + x * 0x10
 4. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> 4) = 1\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Low_cnode_ptr + x * 0x10
 5. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (4 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; cref = Low_cnode_ptr + 0x30\<rbrakk> \<Longrightarrow> 3 \<in> {0..0x3FF}
 2. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> 4) = 2\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Low_cnode_ptr + x * 0x10
 3. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> 4) = 1\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Low_cnode_ptr + x * 0x10
 4. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (3 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> 4) = 2\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Low_cnode_ptr + x * 0x10
 2. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> 4) = 1\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Low_cnode_ptr + x * 0x10
 3. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (3 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; cref = Low_cnode_ptr + 0x20\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Low_cnode_ptr + x * 0x10
 2. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> 4) = 1\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Low_cnode_ptr + x * 0x10
 3. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (4 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; cref = Low_cnode_ptr + 0x20\<rbrakk> \<Longrightarrow> cref = Low_cnode_ptr + 2 * 0x10
 2. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; cref = Low_cnode_ptr + 0x20\<rbrakk> \<Longrightarrow> 2 \<in> {0..0x3FF}
 3. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> 4) = 1\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Low_cnode_ptr + x * 0x10
 4. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (3 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; cref = Low_cnode_ptr + 0x20\<rbrakk> \<Longrightarrow> 2 \<in> {0..0x3FF}
 2. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> 4) = 1\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Low_cnode_ptr + x * 0x10
 3. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; UCAST(32 \<rightarrow> 10) (cref - Low_cnode_ptr >> 4) = 1\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Low_cnode_ptr + x * 0x10
 2. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; cref = Low_cnode_ptr + 0x10\<rbrakk> \<Longrightarrow> \<exists>x\<in>{0..0x3FF}. cref = Low_cnode_ptr + x * 0x10
 2. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (3 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; cref = Low_cnode_ptr + 0x10\<rbrakk> \<Longrightarrow> cref = Low_cnode_ptr + 1 * 0x10
 2. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; cref = Low_cnode_ptr + 0x10\<rbrakk> \<Longrightarrow> 1 \<in> {0..0x3FF}
 3. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. \<And>cref. \<lbrakk>map_to_ctes kh0H cref = Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; cref \<in> cnode_offs_range Low_cnode_ptr; is_aligned cref 4; Low_cnode_ptr \<le> cref; cref \<le> 0x3FFF + Low_cnode_ptr; cref = Low_cnode_ptr + 0x10\<rbrakk> \<Longrightarrow> 1 \<in> {0..0x3FF}
 2. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal \<and> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> valid_idle' s0H_internal
 2. 1 \<le> maxDomain \<Longrightarrow> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> (\<exists>ko. kh0H (ksIdleThread s0H_internal) = Some ko \<and> is_aligned (ksIdleThread s0H_internal) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) \<and> (\<exists>obj. KOTCB obj = ko \<and> idle' (tcbState obj) \<and> tcbBoundNotification obj = None \<and> ps_clear (ksIdleThread s0H_internal) (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s0H_internal)) \<and> idle_thread_ptr = ksIdleThread s0H_internal
 2. 1 \<le> maxDomain \<Longrightarrow> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> ps_clear idle_tcb_ptr 9 \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = init_globals_frame then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(Low_cnode_ptr \<mapsto> 10, High_cnode_ptr \<mapsto> 10, Silc_cnode_ptr \<mapsto> 10, irq_cnode_ptr \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = Low_tcb_ptr, ksIdleThread = idle_tcb_ptr, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState init_irq_node_ptr ((\<lambda>_. irqstate.IRQInactive)(timer_irq := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = arch_state0H, ksMachineState = machine_state0\<rparr> \<and> idle_thread_ptr = idle_tcb_ptr
 2. 1 \<le> maxDomain \<Longrightarrow> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (3 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> ps_clear idle_tcb_ptr 9 \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = init_globals_frame then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(Low_cnode_ptr \<mapsto> 10, High_cnode_ptr \<mapsto> 10, Silc_cnode_ptr \<mapsto> 10, irq_cnode_ptr \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = Low_tcb_ptr, ksIdleThread = idle_tcb_ptr, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState init_irq_node_ptr ((\<lambda>_. irqstate.IRQInactive)(timer_irq := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = arch_state0H, ksMachineState = machine_state0\<rparr>
 2. 1 \<le> maxDomain \<Longrightarrow> idle_thread_ptr = idle_tcb_ptr
 3. 1 \<le> maxDomain \<Longrightarrow> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (3 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> \<exists>v. ksPSpace \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = init_globals_frame then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(Low_cnode_ptr \<mapsto> 10, High_cnode_ptr \<mapsto> 10, Silc_cnode_ptr \<mapsto> 10, irq_cnode_ptr \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = Low_tcb_ptr, ksIdleThread = idle_tcb_ptr, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState init_irq_node_ptr ((\<lambda>_. irqstate.IRQInactive)(timer_irq := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = arch_state0H, ksMachineState = machine_state0\<rparr> idle_tcb_ptr = Some v \<and> objBitsKO v = 9
 2. 1 \<le> maxDomain \<Longrightarrow> idle_thread_ptr = idle_tcb_ptr
 3. 1 \<le> maxDomain \<Longrightarrow> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> idle_thread_ptr = idle_tcb_ptr
 2. 1 \<le> maxDomain \<Longrightarrow> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> valid_global_refs' s0H_internal \<and> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> valid_global_refs' s0H_internal
 2. 1 \<le> maxDomain \<Longrightarrow> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> valid_arch_state' s0H_internal \<and> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> valid_arch_state' s0H_internal
 2. 1 \<le> maxDomain \<Longrightarrow> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> valid_asid_table' (armKSASIDTable (ksArchState s0H_internal)) s0H_internal \<and> page_directory_at' (armKSGlobalPD (ksArchState s0H_internal)) s0H_internal \<and> valid_global_pts' (armKSGlobalPTs (ksArchState s0H_internal)) s0H_internal \<and> is_inv (armKSHWASIDTable (ksArchState s0H_internal)) (map_option fst \<circ> armKSASIDMap (ksArchState s0H_internal)) \<and> valid_asid_map' (armKSASIDMap (ksArchState s0H_internal))
 2. 1 \<le> maxDomain \<Longrightarrow> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (6 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> valid_asid_table' (armKSASIDTable (ksArchState s0H_internal)) s0H_internal
 2. 1 \<le> maxDomain \<Longrightarrow> page_directory_at' (armKSGlobalPD (ksArchState s0H_internal)) s0H_internal
 3. 1 \<le> maxDomain \<Longrightarrow> valid_global_pts' (armKSGlobalPTs (ksArchState s0H_internal)) s0H_internal
 4. 1 \<le> maxDomain \<Longrightarrow> is_inv (armKSHWASIDTable (ksArchState s0H_internal)) (map_option fst \<circ> armKSASIDMap (ksArchState s0H_internal))
 5. 1 \<le> maxDomain \<Longrightarrow> valid_asid_map' (armKSASIDMap (ksArchState s0H_internal))
 6. 1 \<le> maxDomain \<Longrightarrow> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (6 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> valid_asid_table' (\<lambda>x. None) \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = init_globals_frame then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(Low_cnode_ptr \<mapsto> 10, High_cnode_ptr \<mapsto> 10, Silc_cnode_ptr \<mapsto> 10, irq_cnode_ptr \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = Low_tcb_ptr, ksIdleThread = idle_tcb_ptr, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState init_irq_node_ptr ((\<lambda>_. irqstate.IRQInactive)(timer_irq := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = ARMKernelState (\<lambda>x. None) (\<lambda>x. None) 0 (\<lambda>x. None) init_global_pd [] (\<lambda>ref. if kernel_base \<le> ref \<and> ref \<le> kernel_base + mask 20 then ArmVSpaceKernelWindow else ArmVSpaceInvalidRegion), ksMachineState = machine_state0\<rparr>
 2. 1 \<le> maxDomain \<Longrightarrow> page_directory_at' (armKSGlobalPD (ksArchState s0H_internal)) s0H_internal
 3. 1 \<le> maxDomain \<Longrightarrow> valid_global_pts' (armKSGlobalPTs (ksArchState s0H_internal)) s0H_internal
 4. 1 \<le> maxDomain \<Longrightarrow> is_inv (armKSHWASIDTable (ksArchState s0H_internal)) (map_option fst \<circ> armKSASIDMap (ksArchState s0H_internal))
 5. 1 \<le> maxDomain \<Longrightarrow> valid_asid_map' (armKSASIDMap (ksArchState s0H_internal))
 6. 1 \<le> maxDomain \<Longrightarrow> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (6 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> valid_asid_table' (\<lambda>x. None) \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = 0xE0005000 then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(0xE0010000 \<mapsto> 10, 0xE0014000 \<mapsto> 10, 0xE0018000 \<mapsto> 10, 0xE001C000 \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = 0xE0000200, ksIdleThread = 0xE0001000, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState 0xE0008000 ((\<lambda>_. irqstate.IRQInactive)(0xA := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = ARMKernelState (\<lambda>x. None) (\<lambda>x. None) 0 (\<lambda>x. None) 0xE0060000 [] (\<lambda>ref. if 0xE0000000 \<le> ref \<and> ref \<le> 0xE0000000 + mask 20 then ArmVSpaceKernelWindow else ArmVSpaceInvalidRegion), ksMachineState = machine_state0\<rparr>
 2. 1 \<le> maxDomain \<Longrightarrow> page_directory_at' (armKSGlobalPD (ksArchState s0H_internal)) s0H_internal
 3. 1 \<le> maxDomain \<Longrightarrow> valid_global_pts' (armKSGlobalPTs (ksArchState s0H_internal)) s0H_internal
 4. 1 \<le> maxDomain \<Longrightarrow> is_inv (armKSHWASIDTable (ksArchState s0H_internal)) (map_option fst \<circ> armKSASIDMap (ksArchState s0H_internal))
 5. 1 \<le> maxDomain \<Longrightarrow> valid_asid_map' (armKSASIDMap (ksArchState s0H_internal))
 6. 1 \<le> maxDomain \<Longrightarrow> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (6 subgoals):
 1. \<lbrakk>1 \<le> maxDomain; pspace_distinct' s0H_internal\<rbrakk> \<Longrightarrow> valid_asid_table' (\<lambda>x. None) \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = 0xE0005000 then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(0xE0010000 \<mapsto> 10, 0xE0014000 \<mapsto> 10, 0xE0018000 \<mapsto> 10, 0xE001C000 \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = 0xE0000200, ksIdleThread = 0xE0001000, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState 0xE0008000 ((\<lambda>_. irqstate.IRQInactive)(0xA := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = ARMKernelState (\<lambda>x. None) (\<lambda>x. None) 0 (\<lambda>x. None) 0xE0060000 [] (\<lambda>ref. if 0xE0000000 \<le> ref \<and> ref \<le> 0xE0000000 + mask 20 then ArmVSpaceKernelWindow else ArmVSpaceInvalidRegion), ksMachineState = machine_state0\<rparr>
 2. 1 \<le> maxDomain \<Longrightarrow> page_directory_at' (armKSGlobalPD (ksArchState s0H_internal)) s0H_internal
 3. 1 \<le> maxDomain \<Longrightarrow> valid_global_pts' (armKSGlobalPTs (ksArchState s0H_internal)) s0H_internal
 4. 1 \<le> maxDomain \<Longrightarrow> is_inv (armKSHWASIDTable (ksArchState s0H_internal)) (map_option fst \<circ> armKSASIDMap (ksArchState s0H_internal))
 5. 1 \<le> maxDomain \<Longrightarrow> valid_asid_map' (armKSASIDMap (ksArchState s0H_internal))
 6. 1 \<le> maxDomain \<Longrightarrow> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (6 subgoals):
 1. \<lbrakk>1 \<le> maxDomain; pspace_distinct' \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = init_globals_frame then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(Low_cnode_ptr \<mapsto> 10, High_cnode_ptr \<mapsto> 10, Silc_cnode_ptr \<mapsto> 10, irq_cnode_ptr \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = Low_tcb_ptr, ksIdleThread = idle_tcb_ptr, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState init_irq_node_ptr ((\<lambda>_. irqstate.IRQInactive)(timer_irq := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = ARMKernelState (\<lambda>x. None) (\<lambda>x. None) 0 (\<lambda>x. None) init_global_pd [] (\<lambda>ref. if kernel_base \<le> ref \<and> ref \<le> kernel_base + mask 20 then ArmVSpaceKernelWindow else ArmVSpaceInvalidRegion), ksMachineState = machine_state0\<rparr>\<rbrakk> \<Longrightarrow> valid_asid_table' (\<lambda>x. None) \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = 0xE0005000 then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(0xE0010000 \<mapsto> 10, 0xE0014000 \<mapsto> 10, 0xE0018000 \<mapsto> 10, 0xE001C000 \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = 0xE0000200, ksIdleThread = 0xE0001000, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState 0xE0008000 ((\<lambda>_. irqstate.IRQInactive)(0xA := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = ARMKernelState (\<lambda>x. None) (\<lambda>x. None) 0 (\<lambda>x. None) 0xE0060000 [] (\<lambda>ref. if 0xE0000000 \<le> ref \<and> ref \<le> 0xE0000000 + mask 20 then ArmVSpaceKernelWindow else ArmVSpaceInvalidRegion), ksMachineState = machine_state0\<rparr>
 2. 1 \<le> maxDomain \<Longrightarrow> page_directory_at' (armKSGlobalPD (ksArchState s0H_internal)) s0H_internal
 3. 1 \<le> maxDomain \<Longrightarrow> valid_global_pts' (armKSGlobalPTs (ksArchState s0H_internal)) s0H_internal
 4. 1 \<le> maxDomain \<Longrightarrow> is_inv (armKSHWASIDTable (ksArchState s0H_internal)) (map_option fst \<circ> armKSASIDMap (ksArchState s0H_internal))
 5. 1 \<le> maxDomain \<Longrightarrow> valid_asid_map' (armKSASIDMap (ksArchState s0H_internal))
 6. 1 \<le> maxDomain \<Longrightarrow> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> page_directory_at' (armKSGlobalPD (ksArchState s0H_internal)) s0H_internal
 2. 1 \<le> maxDomain \<Longrightarrow> valid_global_pts' (armKSGlobalPTs (ksArchState s0H_internal)) s0H_internal
 3. 1 \<le> maxDomain \<Longrightarrow> is_inv (armKSHWASIDTable (ksArchState s0H_internal)) (map_option fst \<circ> armKSASIDMap (ksArchState s0H_internal))
 4. 1 \<le> maxDomain \<Longrightarrow> valid_asid_map' (armKSASIDMap (ksArchState s0H_internal))
 5. 1 \<le> maxDomain \<Longrightarrow> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>y. \<lbrakk>1 \<le> maxDomain; y < 0x1000\<rbrakk> \<Longrightarrow> pde_at' (init_global_pd + (y << 2)) \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = init_globals_frame then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(Low_cnode_ptr \<mapsto> 10, High_cnode_ptr \<mapsto> 10, Silc_cnode_ptr \<mapsto> 10, irq_cnode_ptr \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = Low_tcb_ptr, ksIdleThread = idle_tcb_ptr, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState init_irq_node_ptr ((\<lambda>_. irqstate.IRQInactive)(timer_irq := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = ARMKernelState (\<lambda>x. None) (\<lambda>x. None) 0 (\<lambda>x. None) init_global_pd [] (\<lambda>ref. if kernel_base \<le> ref \<and> ref \<le> kernel_base + mask 20 then ArmVSpaceKernelWindow else ArmVSpaceInvalidRegion), ksMachineState = machine_state0\<rparr>
 2. 1 \<le> maxDomain \<Longrightarrow> valid_global_pts' (armKSGlobalPTs (ksArchState s0H_internal)) s0H_internal
 3. 1 \<le> maxDomain \<Longrightarrow> is_inv (armKSHWASIDTable (ksArchState s0H_internal)) (map_option fst \<circ> armKSASIDMap (ksArchState s0H_internal))
 4. 1 \<le> maxDomain \<Longrightarrow> valid_asid_map' (armKSASIDMap (ksArchState s0H_internal))
 5. 1 \<le> maxDomain \<Longrightarrow> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>y. \<lbrakk>1 \<le> maxDomain; y < 0x1000\<rbrakk> \<Longrightarrow> \<exists>ko. kh0H (init_global_pd + (y << 2)) = Some ko \<and> is_aligned (init_global_pd + (y << 2)) (objBitsKO ko) \<and> koTypeOf ko = ArchT PDET \<and> ps_clear (init_global_pd + (y << 2)) (objBitsKO ko) \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = init_globals_frame then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(Low_cnode_ptr \<mapsto> 10, High_cnode_ptr \<mapsto> 10, Silc_cnode_ptr \<mapsto> 10, irq_cnode_ptr \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = Low_tcb_ptr, ksIdleThread = idle_tcb_ptr, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState init_irq_node_ptr ((\<lambda>_. irqstate.IRQInactive)(timer_irq := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = ARMKernelState (\<lambda>x. None) (\<lambda>x. None) 0 (\<lambda>x. None) init_global_pd [] (\<lambda>ref. if kernel_base \<le> ref \<and> ref \<le> kernel_base + mask 20 then ArmVSpaceKernelWindow else ArmVSpaceInvalidRegion), ksMachineState = machine_state0\<rparr>
 2. 1 \<le> maxDomain \<Longrightarrow> valid_global_pts' (armKSGlobalPTs (ksArchState s0H_internal)) s0H_internal
 3. 1 \<le> maxDomain \<Longrightarrow> is_inv (armKSHWASIDTable (ksArchState s0H_internal)) (map_option fst \<circ> armKSASIDMap (ksArchState s0H_internal))
 4. 1 \<le> maxDomain \<Longrightarrow> valid_asid_map' (armKSASIDMap (ksArchState s0H_internal))
 5. 1 \<le> maxDomain \<Longrightarrow> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>y. \<lbrakk>1 \<le> maxDomain; \<exists>ya. y = UCAST(12 \<rightarrow> 32) ya\<rbrakk> \<Longrightarrow> \<exists>ko. kh0H (init_global_pd + (y << 2)) = Some ko \<and> is_aligned (init_global_pd + (y << 2)) (objBitsKO ko) \<and> koTypeOf ko = ArchT PDET \<and> ps_clear (init_global_pd + (y << 2)) (objBitsKO ko) \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = init_globals_frame then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(Low_cnode_ptr \<mapsto> 10, High_cnode_ptr \<mapsto> 10, Silc_cnode_ptr \<mapsto> 10, irq_cnode_ptr \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = Low_tcb_ptr, ksIdleThread = idle_tcb_ptr, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState init_irq_node_ptr ((\<lambda>_. irqstate.IRQInactive)(timer_irq := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = ARMKernelState (\<lambda>x. None) (\<lambda>x. None) 0 (\<lambda>x. None) init_global_pd [] (\<lambda>ref. if kernel_base \<le> ref \<and> ref \<le> kernel_base + mask 20 then ArmVSpaceKernelWindow else ArmVSpaceInvalidRegion), ksMachineState = machine_state0\<rparr>
 2. 1 \<le> maxDomain \<Longrightarrow> valid_global_pts' (armKSGlobalPTs (ksArchState s0H_internal)) s0H_internal
 3. 1 \<le> maxDomain \<Longrightarrow> is_inv (armKSHWASIDTable (ksArchState s0H_internal)) (map_option fst \<circ> armKSASIDMap (ksArchState s0H_internal))
 4. 1 \<le> maxDomain \<Longrightarrow> valid_asid_map' (armKSASIDMap (ksArchState s0H_internal))
 5. 1 \<le> maxDomain \<Longrightarrow> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>ya. 1 \<le> maxDomain \<Longrightarrow> \<exists>ko. global_pdH' init_global_pd (init_global_pd + (UCAST(12 \<rightarrow> 32) ya << 2)) = Some ko \<and> is_aligned (init_global_pd + (UCAST(12 \<rightarrow> 32) ya << 2)) (objBitsKO ko) \<and> koTypeOf ko = ArchT PDET \<and> ps_clear (init_global_pd + (UCAST(12 \<rightarrow> 32) ya << 2)) (objBitsKO ko) \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = init_globals_frame then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(Low_cnode_ptr \<mapsto> 10, High_cnode_ptr \<mapsto> 10, Silc_cnode_ptr \<mapsto> 10, irq_cnode_ptr \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = Low_tcb_ptr, ksIdleThread = idle_tcb_ptr, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState init_irq_node_ptr ((\<lambda>_. irqstate.IRQInactive)(timer_irq := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = ARMKernelState (\<lambda>x. None) (\<lambda>x. None) 0 (\<lambda>x. None) init_global_pd [] (\<lambda>ref. if kernel_base \<le> ref \<and> ref \<le> kernel_base + mask 20 then ArmVSpaceKernelWindow else ArmVSpaceInvalidRegion), ksMachineState = machine_state0\<rparr>
 2. 1 \<le> maxDomain \<Longrightarrow> valid_global_pts' (armKSGlobalPTs (ksArchState s0H_internal)) s0H_internal
 3. 1 \<le> maxDomain \<Longrightarrow> is_inv (armKSHWASIDTable (ksArchState s0H_internal)) (map_option fst \<circ> armKSASIDMap (ksArchState s0H_internal))
 4. 1 \<le> maxDomain \<Longrightarrow> valid_asid_map' (armKSASIDMap (ksArchState s0H_internal))
 5. 1 \<le> maxDomain \<Longrightarrow> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>ya. \<lbrakk>1 \<le> maxDomain; init_global_pd + (UCAST(12 \<rightarrow> 32) ya << 2) \<in> pd_offs_range init_global_pd\<rbrakk> \<Longrightarrow> \<exists>ko. global_pdH' init_global_pd (init_global_pd + (UCAST(12 \<rightarrow> 32) ya << 2)) = Some ko \<and> is_aligned (init_global_pd + (UCAST(12 \<rightarrow> 32) ya << 2)) (objBitsKO ko) \<and> koTypeOf ko = ArchT PDET \<and> ps_clear (init_global_pd + (UCAST(12 \<rightarrow> 32) ya << 2)) (objBitsKO ko) \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = init_globals_frame then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(Low_cnode_ptr \<mapsto> 10, High_cnode_ptr \<mapsto> 10, Silc_cnode_ptr \<mapsto> 10, irq_cnode_ptr \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = Low_tcb_ptr, ksIdleThread = idle_tcb_ptr, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState init_irq_node_ptr ((\<lambda>_. irqstate.IRQInactive)(timer_irq := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = ARMKernelState (\<lambda>x. None) (\<lambda>x. None) 0 (\<lambda>x. None) init_global_pd [] (\<lambda>ref. if kernel_base \<le> ref \<and> ref \<le> kernel_base + mask 20 then ArmVSpaceKernelWindow else ArmVSpaceInvalidRegion), ksMachineState = machine_state0\<rparr>
 2. 1 \<le> maxDomain \<Longrightarrow> valid_global_pts' (armKSGlobalPTs (ksArchState s0H_internal)) s0H_internal
 3. 1 \<le> maxDomain \<Longrightarrow> is_inv (armKSHWASIDTable (ksArchState s0H_internal)) (map_option fst \<circ> armKSASIDMap (ksArchState s0H_internal))
 4. 1 \<le> maxDomain \<Longrightarrow> valid_asid_map' (armKSASIDMap (ksArchState s0H_internal))
 5. 1 \<le> maxDomain \<Longrightarrow> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>ya. \<lbrakk>1 \<le> maxDomain; init_global_pd \<le> init_global_pd + (UCAST(12 \<rightarrow> 32) ya << 2); init_global_pd + (UCAST(12 \<rightarrow> 32) ya << 2) \<le> 0x3FFF + init_global_pd; is_aligned (init_global_pd + (UCAST(12 \<rightarrow> 32) ya << 2)) 2\<rbrakk> \<Longrightarrow> ps_clear (init_global_pd + (UCAST(12 \<rightarrow> 32) ya << 2)) 2 \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = init_globals_frame then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(Low_cnode_ptr \<mapsto> 10, High_cnode_ptr \<mapsto> 10, Silc_cnode_ptr \<mapsto> 10, irq_cnode_ptr \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = Low_tcb_ptr, ksIdleThread = idle_tcb_ptr, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState init_irq_node_ptr ((\<lambda>_. irqstate.IRQInactive)(timer_irq := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = ARMKernelState (\<lambda>x. None) (\<lambda>x. None) 0 (\<lambda>x. None) init_global_pd [] (\<lambda>ref. if kernel_base \<le> ref \<and> ref \<le> kernel_base + mask 20 then ArmVSpaceKernelWindow else ArmVSpaceInvalidRegion), ksMachineState = machine_state0\<rparr>
 2. 1 \<le> maxDomain \<Longrightarrow> valid_global_pts' (armKSGlobalPTs (ksArchState s0H_internal)) s0H_internal
 3. 1 \<le> maxDomain \<Longrightarrow> is_inv (armKSHWASIDTable (ksArchState s0H_internal)) (map_option fst \<circ> armKSASIDMap (ksArchState s0H_internal))
 4. 1 \<le> maxDomain \<Longrightarrow> valid_asid_map' (armKSASIDMap (ksArchState s0H_internal))
 5. 1 \<le> maxDomain \<Longrightarrow> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (6 subgoals):
 1. \<And>ya. \<lbrakk>1 \<le> maxDomain; init_global_pd \<le> init_global_pd + (UCAST(12 \<rightarrow> 32) ya << 2); init_global_pd + (UCAST(12 \<rightarrow> 32) ya << 2) \<le> 0x3FFF + init_global_pd; is_aligned (init_global_pd + (UCAST(12 \<rightarrow> 32) ya << 2)) 2\<rbrakk> \<Longrightarrow> \<exists>v. ksPSpace \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = init_globals_frame then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(Low_cnode_ptr \<mapsto> 10, High_cnode_ptr \<mapsto> 10, Silc_cnode_ptr \<mapsto> 10, irq_cnode_ptr \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = Low_tcb_ptr, ksIdleThread = idle_tcb_ptr, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState init_irq_node_ptr ((\<lambda>_. irqstate.IRQInactive)(timer_irq := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = ARMKernelState (\<lambda>x. None) (\<lambda>x. None) 0 (\<lambda>x. None) init_global_pd [] (\<lambda>ref. if kernel_base \<le> ref \<and> ref \<le> kernel_base + mask 20 then ArmVSpaceKernelWindow else ArmVSpaceInvalidRegion), ksMachineState = machine_state0\<rparr> (init_global_pd + (UCAST(12 \<rightarrow> 32) ya << 2)) = Some v \<and> objBitsKO v = 2
 2. \<And>ya. \<lbrakk>1 \<le> maxDomain; init_global_pd \<le> init_global_pd + (UCAST(12 \<rightarrow> 32) ya << 2); init_global_pd + (UCAST(12 \<rightarrow> 32) ya << 2) \<le> 0x3FFF + init_global_pd; is_aligned (init_global_pd + (UCAST(12 \<rightarrow> 32) ya << 2)) 2\<rbrakk> \<Longrightarrow> pspace_distinct' \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = init_globals_frame then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(Low_cnode_ptr \<mapsto> 10, High_cnode_ptr \<mapsto> 10, Silc_cnode_ptr \<mapsto> 10, irq_cnode_ptr \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = Low_tcb_ptr, ksIdleThread = idle_tcb_ptr, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState init_irq_node_ptr ((\<lambda>_. irqstate.IRQInactive)(timer_irq := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = ARMKernelState (\<lambda>x. None) (\<lambda>x. None) 0 (\<lambda>x. None) init_global_pd [] (\<lambda>ref. if kernel_base \<le> ref \<and> ref \<le> kernel_base + mask 20 then ArmVSpaceKernelWindow else ArmVSpaceInvalidRegion), ksMachineState = machine_state0\<rparr>
 3. 1 \<le> maxDomain \<Longrightarrow> valid_global_pts' (armKSGlobalPTs (ksArchState s0H_internal)) s0H_internal
 4. 1 \<le> maxDomain \<Longrightarrow> is_inv (armKSHWASIDTable (ksArchState s0H_internal)) (map_option fst \<circ> armKSASIDMap (ksArchState s0H_internal))
 5. 1 \<le> maxDomain \<Longrightarrow> valid_asid_map' (armKSASIDMap (ksArchState s0H_internal))
 6. 1 \<le> maxDomain \<Longrightarrow> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>ya. \<lbrakk>1 \<le> maxDomain; init_global_pd \<le> init_global_pd + (UCAST(12 \<rightarrow> 32) ya << 2); init_global_pd + (UCAST(12 \<rightarrow> 32) ya << 2) \<le> 0x3FFF + init_global_pd; is_aligned (init_global_pd + (UCAST(12 \<rightarrow> 32) ya << 2)) 2\<rbrakk> \<Longrightarrow> pspace_distinct' \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = init_globals_frame then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(Low_cnode_ptr \<mapsto> 10, High_cnode_ptr \<mapsto> 10, Silc_cnode_ptr \<mapsto> 10, irq_cnode_ptr \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = Low_tcb_ptr, ksIdleThread = idle_tcb_ptr, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState init_irq_node_ptr ((\<lambda>_. irqstate.IRQInactive)(timer_irq := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = ARMKernelState (\<lambda>x. None) (\<lambda>x. None) 0 (\<lambda>x. None) init_global_pd [] (\<lambda>ref. if kernel_base \<le> ref \<and> ref \<le> kernel_base + mask 20 then ArmVSpaceKernelWindow else ArmVSpaceInvalidRegion), ksMachineState = machine_state0\<rparr>
 2. 1 \<le> maxDomain \<Longrightarrow> valid_global_pts' (armKSGlobalPTs (ksArchState s0H_internal)) s0H_internal
 3. 1 \<le> maxDomain \<Longrightarrow> is_inv (armKSHWASIDTable (ksArchState s0H_internal)) (map_option fst \<circ> armKSASIDMap (ksArchState s0H_internal))
 4. 1 \<le> maxDomain \<Longrightarrow> valid_asid_map' (armKSASIDMap (ksArchState s0H_internal))
 5. 1 \<le> maxDomain \<Longrightarrow> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>ya. \<lbrakk>1 \<le> maxDomain; init_global_pd \<le> init_global_pd + (UCAST(12 \<rightarrow> 32) ya << 2); init_global_pd + (UCAST(12 \<rightarrow> 32) ya << 2) \<le> 0x3FFF + init_global_pd; is_aligned (init_global_pd + (UCAST(12 \<rightarrow> 32) ya << 2)) 2; pspace_distinct' s0H_internal\<rbrakk> \<Longrightarrow> pspace_distinct' \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = init_globals_frame then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(Low_cnode_ptr \<mapsto> 10, High_cnode_ptr \<mapsto> 10, Silc_cnode_ptr \<mapsto> 10, irq_cnode_ptr \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = Low_tcb_ptr, ksIdleThread = idle_tcb_ptr, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState init_irq_node_ptr ((\<lambda>_. irqstate.IRQInactive)(timer_irq := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = ARMKernelState (\<lambda>x. None) (\<lambda>x. None) 0 (\<lambda>x. None) init_global_pd [] (\<lambda>ref. if kernel_base \<le> ref \<and> ref \<le> kernel_base + mask 20 then ArmVSpaceKernelWindow else ArmVSpaceInvalidRegion), ksMachineState = machine_state0\<rparr>
 2. 1 \<le> maxDomain \<Longrightarrow> valid_global_pts' (armKSGlobalPTs (ksArchState s0H_internal)) s0H_internal
 3. 1 \<le> maxDomain \<Longrightarrow> is_inv (armKSHWASIDTable (ksArchState s0H_internal)) (map_option fst \<circ> armKSASIDMap (ksArchState s0H_internal))
 4. 1 \<le> maxDomain \<Longrightarrow> valid_asid_map' (armKSASIDMap (ksArchState s0H_internal))
 5. 1 \<le> maxDomain \<Longrightarrow> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (4 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> valid_global_pts' (armKSGlobalPTs (ksArchState s0H_internal)) s0H_internal
 2. 1 \<le> maxDomain \<Longrightarrow> is_inv (armKSHWASIDTable (ksArchState s0H_internal)) (map_option fst \<circ> armKSASIDMap (ksArchState s0H_internal))
 3. 1 \<le> maxDomain \<Longrightarrow> valid_asid_map' (armKSASIDMap (ksArchState s0H_internal))
 4. 1 \<le> maxDomain \<Longrightarrow> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (3 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> is_inv (armKSHWASIDTable (ksArchState s0H_internal)) (map_option fst \<circ> armKSASIDMap (ksArchState s0H_internal))
 2. 1 \<le> maxDomain \<Longrightarrow> valid_asid_map' (armKSASIDMap (ksArchState s0H_internal))
 3. 1 \<le> maxDomain \<Longrightarrow> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> valid_asid_map' (armKSASIDMap (ksArchState s0H_internal))
 2. 1 \<le> maxDomain \<Longrightarrow> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> valid_irq_node' (irq_node' s0H_internal) s0H_internal \<and> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> valid_irq_node' (irq_node' s0H_internal) s0H_internal
 2. 1 \<le> maxDomain \<Longrightarrow> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> is_aligned (irq_node' s0H_internal) (size 0 + 4) \<and> (\<forall>irq. real_cte_at' (irq_node' s0H_internal + (UCAST(10 \<rightarrow> 32) irq << 4)) s0H_internal)
 2. 1 \<le> maxDomain \<Longrightarrow> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (3 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> is_aligned (irq_node' s0H_internal) (size 0 + 4)
 2. 1 \<le> maxDomain \<Longrightarrow> \<forall>irq. real_cte_at' (irq_node' s0H_internal + (UCAST(10 \<rightarrow> 32) irq << 4)) s0H_internal
 3. 1 \<le> maxDomain \<Longrightarrow> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> \<forall>irq. real_cte_at' (irq_node' s0H_internal + (UCAST(10 \<rightarrow> 32) irq << 4)) s0H_internal
 2. 1 \<le> maxDomain \<Longrightarrow> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. \<And>irq. 1 \<le> maxDomain \<Longrightarrow> is_aligned (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << 4)) 4 \<and> ps_clear (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << 4)) 4 \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = init_globals_frame then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(Low_cnode_ptr \<mapsto> 10, High_cnode_ptr \<mapsto> 10, Silc_cnode_ptr \<mapsto> 10, irq_cnode_ptr \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = Low_tcb_ptr, ksIdleThread = idle_tcb_ptr, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState init_irq_node_ptr ((\<lambda>_. irqstate.IRQInactive)(timer_irq := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = arch_state0H, ksMachineState = machine_state0\<rparr>
 2. 1 \<le> maxDomain \<Longrightarrow> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (3 subgoals):
 1. \<And>irq. 1 \<le> maxDomain \<Longrightarrow> is_aligned (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << 4)) 4
 2. \<And>irq. 1 \<le> maxDomain \<Longrightarrow> ps_clear (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << 4)) 4 \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = init_globals_frame then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(Low_cnode_ptr \<mapsto> 10, High_cnode_ptr \<mapsto> 10, Silc_cnode_ptr \<mapsto> 10, irq_cnode_ptr \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = Low_tcb_ptr, ksIdleThread = idle_tcb_ptr, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState init_irq_node_ptr ((\<lambda>_. irqstate.IRQInactive)(timer_irq := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = arch_state0H, ksMachineState = machine_state0\<rparr>
 3. 1 \<le> maxDomain \<Longrightarrow> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (4 subgoals):
 1. \<And>irq. 1 \<le> maxDomain \<Longrightarrow> is_aligned init_irq_node_ptr 4
 2. \<And>irq. 1 \<le> maxDomain \<Longrightarrow> is_aligned (UCAST(10 \<rightarrow> 32) irq << 4) 4
 3. \<And>irq. 1 \<le> maxDomain \<Longrightarrow> ps_clear (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << 4)) 4 \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = init_globals_frame then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(Low_cnode_ptr \<mapsto> 10, High_cnode_ptr \<mapsto> 10, Silc_cnode_ptr \<mapsto> 10, irq_cnode_ptr \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = Low_tcb_ptr, ksIdleThread = idle_tcb_ptr, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState init_irq_node_ptr ((\<lambda>_. irqstate.IRQInactive)(timer_irq := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = arch_state0H, ksMachineState = machine_state0\<rparr>
 4. 1 \<le> maxDomain \<Longrightarrow> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (3 subgoals):
 1. \<And>irq. 1 \<le> maxDomain \<Longrightarrow> is_aligned (UCAST(10 \<rightarrow> 32) irq << 4) 4
 2. \<And>irq. 1 \<le> maxDomain \<Longrightarrow> ps_clear (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << 4)) 4 \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = init_globals_frame then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(Low_cnode_ptr \<mapsto> 10, High_cnode_ptr \<mapsto> 10, Silc_cnode_ptr \<mapsto> 10, irq_cnode_ptr \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = Low_tcb_ptr, ksIdleThread = idle_tcb_ptr, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState init_irq_node_ptr ((\<lambda>_. irqstate.IRQInactive)(timer_irq := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = arch_state0H, ksMachineState = machine_state0\<rparr>
 3. 1 \<le> maxDomain \<Longrightarrow> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. \<And>irq. 1 \<le> maxDomain \<Longrightarrow> ps_clear (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << 4)) 4 \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = init_globals_frame then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(Low_cnode_ptr \<mapsto> 10, High_cnode_ptr \<mapsto> 10, Silc_cnode_ptr \<mapsto> 10, irq_cnode_ptr \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = Low_tcb_ptr, ksIdleThread = idle_tcb_ptr, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState init_irq_node_ptr ((\<lambda>_. irqstate.IRQInactive)(timer_irq := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = arch_state0H, ksMachineState = machine_state0\<rparr>
 2. 1 \<le> maxDomain \<Longrightarrow> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. \<And>irq. 1 \<le> maxDomain \<Longrightarrow> \<exists>v. ksPSpace \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = init_globals_frame then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(Low_cnode_ptr \<mapsto> 10, High_cnode_ptr \<mapsto> 10, Silc_cnode_ptr \<mapsto> 10, irq_cnode_ptr \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = Low_tcb_ptr, ksIdleThread = idle_tcb_ptr, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState init_irq_node_ptr ((\<lambda>_. irqstate.IRQInactive)(timer_irq := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = arch_state0H, ksMachineState = machine_state0\<rparr> (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << 4)) = Some v \<and> objBitsKO v = 4
 2. 1 \<le> maxDomain \<Longrightarrow> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> valid_irq_handlers' s0H_internal \<and> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> valid_irq_handlers' s0H_internal
 2. 1 \<le> maxDomain \<Longrightarrow> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. \<And>a z irq. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H a = Some z; cteCap z = capability.IRQHandlerCap irq\<rbrakk> \<Longrightarrow> irq_issued' irq s0H_internal
 2. 1 \<le> maxDomain \<Longrightarrow> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. \<And>a z irq. \<lbrakk>1 \<le> maxDomain; cteCap z = capability.IRQHandlerCap irq; a = idle_tcb_ptr \<and> z = CTE capability.NullCap (MDB 0 0 False False) \<or> a = idle_tcb_ptr + 0x10 \<and> z = CTE capability.NullCap (MDB 0 0 False False) \<or> a = idle_tcb_ptr + 0x20 \<and> z = CTE capability.NullCap (MDB 0 0 False False) \<or> a = idle_tcb_ptr + 0x30 \<and> z = CTE capability.NullCap (MDB 0 0 False False) \<or> a = idle_tcb_ptr + 0x40 \<and> z = CTE capability.NullCap (MDB 0 0 False False) \<or> a = Low_tcb_ptr \<and> z = CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB (Low_cnode_ptr + 0x20) 0 False False) \<or> a = Low_tcb_ptr + 0x10 \<and> z = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False) \<or> a = Low_tcb_ptr + 0x20 \<and> z = CTE (capability.ReplyCap Low_tcb_ptr True True) (MDB 0 0 True True) \<or> a = Low_tcb_ptr + 0x30 \<and> z = CTE capability.NullCap (MDB 0 0 False False) \<or> a = Low_tcb_ptr + 0x40 \<and> z = CTE capability.NullCap (MDB 0 0 False False) \<or> a = High_tcb_ptr \<and> z = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False) \<or> a = High_tcb_ptr + 0x10 \<and> z = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False) \<or> a = High_tcb_ptr + 0x20 \<and> z = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True) \<or> a = High_tcb_ptr + 0x30 \<and> z = CTE capability.NullCap (MDB 0 0 False False) \<or> a = High_tcb_ptr + 0x40 \<and> z = CTE capability.NullCap (MDB 0 0 False False) \<or> a = irq_cnode_ptr \<and> z = CTE capability.NullCap (MDB 0 0 False False) \<or> a \<in> irq_node_offs_range \<and> z = CTE capability.NullCap (MDB 0 0 False False) \<or> a \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte_cte Silc_cnode_ptr a \<noteq> None \<and> z = the (Silc_cte_cte Silc_cnode_ptr a) \<or> a \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr a \<noteq> None \<and> z = the (High_cte_cte High_cnode_ptr a) \<or> a \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr a \<noteq> None \<and> z = the (Low_cte_cte Low_cnode_ptr a)\<rbrakk> \<Longrightarrow> irq_issued' irq s0H_internal
 2. 1 \<le> maxDomain \<Longrightarrow> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (4 subgoals):
 1. \<And>a irq. \<lbrakk>1 \<le> maxDomain; cteCap (the (if is_aligned a cte_level_bits \<and> Silc_cnode_ptr \<le> a \<and> a \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (a - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) = capability.IRQHandlerCap irq; a \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. (if is_aligned a cte_level_bits \<and> Silc_cnode_ptr \<le> a \<and> a \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (a - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> irq_issued' irq s0H_internal
 2. \<And>a irq. \<lbrakk>1 \<le> maxDomain; cteCap (the (if is_aligned a cte_level_bits \<and> High_cnode_ptr \<le> a \<and> a \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (a - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) = capability.IRQHandlerCap irq; a \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned a cte_level_bits \<and> High_cnode_ptr \<le> a \<and> a \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (a - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> irq_issued' irq s0H_internal
 3. \<And>a irq. \<lbrakk>1 \<le> maxDomain; cteCap (the (if is_aligned a cte_level_bits \<and> Low_cnode_ptr \<le> a \<and> a \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (a - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) = capability.IRQHandlerCap irq; a \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned a cte_level_bits \<and> Low_cnode_ptr \<le> a \<and> a \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (a - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> irq_issued' irq s0H_internal
 4. 1 \<le> maxDomain \<Longrightarrow> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> valid_irq_states' s0H_internal \<and> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> valid_irq_states' s0H_internal
 2. 1 \<le> maxDomain \<Longrightarrow> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> valid_machine_state' s0H_internal \<and> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> valid_machine_state' s0H_internal
 2. 1 \<le> maxDomain \<Longrightarrow> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> irqs_masked' s0H_internal \<and> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> irqs_masked' s0H_internal
 2. 1 \<le> maxDomain \<Longrightarrow> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> valid_queues' s0H_internal \<and> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> valid_queues' s0H_internal
 2. 1 \<le> maxDomain \<Longrightarrow> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. \<And>t obj. \<lbrakk>1 \<le> maxDomain; is_aligned t (objBitsKO (KOTCB obj)); kh0H t = Some (KOTCB obj); tcbQueued obj; ps_clear t (objBitsKO (KOTCB obj)) \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = init_globals_frame then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(Low_cnode_ptr \<mapsto> 10, High_cnode_ptr \<mapsto> 10, Silc_cnode_ptr \<mapsto> 10, irq_cnode_ptr \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = Low_tcb_ptr, ksIdleThread = idle_tcb_ptr, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState init_irq_node_ptr ((\<lambda>_. irqstate.IRQInactive)(timer_irq := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = arch_state0H, ksMachineState = machine_state0\<rparr>\<rbrakk> \<Longrightarrow> False
 2. 1 \<le> maxDomain \<Longrightarrow> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. \<And>t obj. \<lbrakk>1 \<le> maxDomain; is_aligned t (objBitsKO (KOTCB obj)); kh0H t = Some (KOTCB obj); tcbQueued obj; ps_clear t (objBitsKO (KOTCB obj)) \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = init_globals_frame then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(Low_cnode_ptr \<mapsto> 10, High_cnode_ptr \<mapsto> 10, Silc_cnode_ptr \<mapsto> 10, irq_cnode_ptr \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = Low_tcb_ptr, ksIdleThread = idle_tcb_ptr, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState init_irq_node_ptr ((\<lambda>_. irqstate.IRQInactive)(timer_irq := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = arch_state0H, ksMachineState = machine_state0\<rparr>; t = Low_tcb_ptr \<or> t = High_tcb_ptr \<or> t = idle_tcb_ptr\<rbrakk> \<Longrightarrow> False
 2. 1 \<le> maxDomain \<Longrightarrow> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> ct_not_inQ s0H_internal \<and> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> ct_not_inQ s0H_internal
 2. 1 \<le> maxDomain \<Longrightarrow> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> ps_clear Low_tcb_ptr 9 \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = init_globals_frame then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(Low_cnode_ptr \<mapsto> 10, High_cnode_ptr \<mapsto> 10, Silc_cnode_ptr \<mapsto> 10, irq_cnode_ptr \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = Low_tcb_ptr, ksIdleThread = idle_tcb_ptr, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState init_irq_node_ptr ((\<lambda>_. irqstate.IRQInactive)(timer_irq := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = arch_state0H, ksMachineState = machine_state0\<rparr>
 2. 1 \<le> maxDomain \<Longrightarrow> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> \<exists>v. ksPSpace \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = init_globals_frame then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(Low_cnode_ptr \<mapsto> 10, High_cnode_ptr \<mapsto> 10, Silc_cnode_ptr \<mapsto> 10, irq_cnode_ptr \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = Low_tcb_ptr, ksIdleThread = idle_tcb_ptr, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState init_irq_node_ptr ((\<lambda>_. irqstate.IRQInactive)(timer_irq := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = arch_state0H, ksMachineState = machine_state0\<rparr> Low_tcb_ptr = Some v \<and> objBitsKO v = 9
 2. 1 \<le> maxDomain \<Longrightarrow> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> ct_idle_or_in_cur_domain' s0H_internal \<and> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> ct_idle_or_in_cur_domain' s0H_internal
 2. 1 \<le> maxDomain \<Longrightarrow> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> ps_clear Low_tcb_ptr 9 \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = init_globals_frame then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(Low_cnode_ptr \<mapsto> 10, High_cnode_ptr \<mapsto> 10, Silc_cnode_ptr \<mapsto> 10, irq_cnode_ptr \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = Low_tcb_ptr, ksIdleThread = idle_tcb_ptr, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState init_irq_node_ptr ((\<lambda>_. irqstate.IRQInactive)(timer_irq := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = arch_state0H, ksMachineState = machine_state0\<rparr>
 2. 1 \<le> maxDomain \<Longrightarrow> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> \<exists>v. ksPSpace \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = init_globals_frame then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(Low_cnode_ptr \<mapsto> 10, High_cnode_ptr \<mapsto> 10, Silc_cnode_ptr \<mapsto> 10, irq_cnode_ptr \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = Low_tcb_ptr, ksIdleThread = idle_tcb_ptr, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState init_irq_node_ptr ((\<lambda>_. irqstate.IRQInactive)(timer_irq := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = arch_state0H, ksMachineState = machine_state0\<rparr> Low_tcb_ptr = Some v \<and> objBitsKO v = 9
 2. 1 \<le> maxDomain \<Longrightarrow> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> valid_pde_mappings' s0H_internal \<and> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> valid_pde_mappings' s0H_internal
 2. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. \<And>x pde. \<lbrakk>1 \<le> maxDomain; kh0H x = Some (KOArch (KOPDE pde)); is_aligned x (objBitsKO (KOArch (KOPDE pde))); ps_clear x (objBitsKO (KOArch (KOPDE pde))) s0H_internal\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 2. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (KOArch (KOPDE pde))); ps_clear x (objBitsKO (KOArch (KOPDE pde))) s0H_internal; x = init_globals_frame \<and> KOArch (KOPDE pde) = KOUserData \<or> x = idle_tcb_ptr \<and> KOArch (KOPDE pde) = KOTCB idle_tcbH \<or> x = High_tcb_ptr \<and> KOArch (KOPDE pde) = KOTCB High_tcbH \<or> x = Low_tcb_ptr \<and> KOArch (KOPDE pde) = KOTCB Low_tcbH \<or> x = ntfn_ptr \<and> KOArch (KOPDE pde) = KONotification ntfnH \<or> x = irq_cnode_ptr \<and> KOArch (KOPDE pde) = KOCTE irq_cte \<or> x \<in> irq_node_offs_range \<and> KOArch (KOPDE pde) = KOCTE (CTE capability.NullCap (MDB 0 0 False False)) \<or> x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> KOArch (KOPDE pde) = the (Low_cte Low_cnode_ptr x) \<or> x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> KOArch (KOPDE pde) = the (High_cte High_cnode_ptr x) \<or> x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> KOArch (KOPDE pde) = the (Silc_cte Silc_cnode_ptr x) \<or> x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> KOArch (KOPDE pde) = the (global_pdH' init_global_pd x) \<or> x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> KOArch (KOPDE pde) = the (High_pdH High_pd_ptr x) \<or> x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> KOArch (KOPDE pde) = the (Low_pdH Low_pd_ptr x) \<or> x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> KOArch (KOPDE pde) = the (High_ptH High_pt_ptr x) \<or> x \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr x \<noteq> None \<and> KOArch (KOPDE pde) = the (Low_ptH Low_pt_ptr x)\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 2. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (9 subgoals):
 1. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (if is_aligned x cte_level_bits \<and> Low_cnode_ptr \<le> x \<and> x \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None))); ps_clear x (objBitsKO (the (if is_aligned x cte_level_bits \<and> Low_cnode_ptr \<le> x \<and> x \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None))) s0H_internal; x \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned x cte_level_bits \<and> Low_cnode_ptr \<le> x \<and> x \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) = Some y) \<and> KOArch (KOPDE pde) = the (if is_aligned x cte_level_bits \<and> Low_cnode_ptr \<le> x \<and> x \<le> 0x3FFF + Low_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None)\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 2. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (if is_aligned x cte_level_bits \<and> High_cnode_ptr \<le> x \<and> x \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (x - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (x - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (x - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (x - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None))); ps_clear x (objBitsKO (the (if is_aligned x cte_level_bits \<and> High_cnode_ptr \<le> x \<and> x \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (x - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (x - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (x - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (x - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None))) s0H_internal; x \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned x cte_level_bits \<and> High_cnode_ptr \<le> x \<and> x \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (x - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (x - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (x - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (x - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) = Some y) \<and> KOArch (KOPDE pde) = the (if is_aligned x cte_level_bits \<and> High_cnode_ptr \<le> x \<and> x \<le> 0x3FFF + High_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (x - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (x - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (x - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (x - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None)\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (if is_aligned x cte_level_bits \<and> Silc_cnode_ptr \<le> x \<and> x \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None))); ps_clear x (objBitsKO (the (if is_aligned x cte_level_bits \<and> Silc_cnode_ptr \<le> x \<and> x \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None))) s0H_internal; x \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. (if is_aligned x cte_level_bits \<and> Silc_cnode_ptr \<le> x \<and> x \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None) = Some y) \<and> KOArch (KOPDE pde) = the (if is_aligned x cte_level_bits \<and> Silc_cnode_ptr \<le> x \<and> x \<le> 0x3FFF + Silc_cnode_ptr then map_option KOCTE (if to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False))) else None)\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> init_global_pd \<le> x \<and> x \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (x - init_global_pd >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> init_global_pd \<le> x \<and> x \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (x - init_global_pd >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range init_global_pd \<and> (\<exists>y. (if is_aligned x 2 \<and> init_global_pd \<le> x \<and> x \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (x - init_global_pd >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> init_global_pd \<le> x \<and> x \<le> 0x3FFF + init_global_pd then Some (UCAST(32 \<rightarrow> 12) (x - init_global_pd >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr High_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr High_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr High_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 6. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 7. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 8. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 9. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (6 subgoals):
 1. \<And>x. \<lbrakk>1 \<le> maxDomain; x \<in> pd_offs_range init_global_pd; is_aligned x 2; init_global_pd \<le> x; x \<le> 0x3FFF + init_global_pd; UCAST(32 \<rightarrow> 12) (x - init_global_pd >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); is_aligned x (objBitsKO (KOArch (KOPDE (ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}))))); ps_clear x (objBitsKO (KOArch (KOPDE (ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}))))) s0H_internal\<rbrakk> \<Longrightarrow> valid_pde_mapping_offset' (x && mask pdBits)
 2. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr High_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr High_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr High_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 6. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (6 subgoals):
 1. \<And>x. \<lbrakk>1 \<le> maxDomain; x \<in> pd_offs_range init_global_pd; is_aligned x 2; init_global_pd \<le> x; x \<le> 0x3FFF + init_global_pd; UCAST(32 \<rightarrow> 12) (x - init_global_pd >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; x && mask 14 = 0x3FC0\<rbrakk> \<Longrightarrow> False
 2. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr High_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr High_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr High_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 6. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (7 subgoals):
 1. \<And>x. \<lbrakk>1 \<le> maxDomain; x \<in> pd_offs_range init_global_pd; is_aligned x 2; init_global_pd \<le> x; x \<le> 0x3FFF + init_global_pd; UCAST(32 \<rightarrow> 12) (x - init_global_pd >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; x && mask 14 = 0x3FC0\<rbrakk> \<Longrightarrow> LENGTH(12) \<le> 12
 2. \<And>x. \<lbrakk>1 \<le> maxDomain; x \<in> pd_offs_range init_global_pd; is_aligned x 2; init_global_pd \<le> x; x \<le> 0x3FFF + init_global_pd; UCAST(32 \<rightarrow> 12) (x - init_global_pd >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) ((x - init_global_pd >> 2) && mask 12) = UCAST(32 \<rightarrow> 12) (x - init_global_pd >> 2)\<rbrakk> \<Longrightarrow> False
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr High_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr High_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr High_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 6. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 7. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (6 subgoals):
 1. \<And>x. \<lbrakk>1 \<le> maxDomain; x \<in> pd_offs_range init_global_pd; is_aligned x 2; init_global_pd \<le> x; x \<le> 0x3FFF + init_global_pd; UCAST(32 \<rightarrow> 12) (x - init_global_pd >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) ((x - init_global_pd >> 2) && mask 12) = UCAST(32 \<rightarrow> 12) (x - init_global_pd >> 2)\<rbrakk> \<Longrightarrow> False
 2. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr High_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr High_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr High_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 6. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (6 subgoals):
 1. \<And>x. \<lbrakk>1 \<le> maxDomain; x \<in> pd_offs_range init_global_pd; is_aligned x 2; init_global_pd \<le> x; x \<le> 0x3FFF + init_global_pd; UCAST(32 \<rightarrow> 12) (x - init_global_pd >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) (x - init_global_pd && mask (12 + 2) >> 2) = UCAST(32 \<rightarrow> 12) (x - init_global_pd >> 2)\<rbrakk> \<Longrightarrow> False
 2. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr High_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr High_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr High_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 6. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (6 subgoals):
 1. \<And>x. \<lbrakk>1 \<le> maxDomain; x \<in> pd_offs_range init_global_pd; is_aligned x 2; init_global_pd \<le> x; x \<le> 0x3FFF + init_global_pd; UCAST(32 \<rightarrow> 12) (x - init_global_pd >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) (x - init_global_pd && mask 14 >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20)\<rbrakk> \<Longrightarrow> False
 2. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr High_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr High_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr High_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 6. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (6 subgoals):
 1. \<And>x. \<lbrakk>1 \<le> maxDomain; x \<in> pd_offs_range init_global_pd; is_aligned x 2; init_global_pd \<le> x; x \<le> 0x3FFF + init_global_pd; UCAST(32 \<rightarrow> 12) (x - init_global_pd >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) (x - (init_global_pd && mask 14) && mask 14 >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20)\<rbrakk> \<Longrightarrow> False
 2. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr High_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr High_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr High_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 6. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (7 subgoals):
 1. \<And>x. \<lbrakk>1 \<le> maxDomain; x \<in> pd_offs_range init_global_pd; is_aligned x 2; init_global_pd \<le> x; x \<le> 0x3FFF + init_global_pd; UCAST(32 \<rightarrow> 12) (x - init_global_pd >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; x && mask 14 = 0x3FC0\<rbrakk> \<Longrightarrow> is_aligned init_global_pd 14
 2. \<And>x. \<lbrakk>1 \<le> maxDomain; x \<in> pd_offs_range init_global_pd; is_aligned x 2; init_global_pd \<le> x; x \<le> 0x3FFF + init_global_pd; UCAST(32 \<rightarrow> 12) (x - init_global_pd >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) (x - 0 && mask 14 >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20)\<rbrakk> \<Longrightarrow> False
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr High_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr High_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr High_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 6. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 7. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (6 subgoals):
 1. \<And>x. \<lbrakk>1 \<le> maxDomain; x \<in> pd_offs_range init_global_pd; is_aligned x 2; init_global_pd \<le> x; x \<le> 0x3FFF + init_global_pd; UCAST(32 \<rightarrow> 12) (x - init_global_pd >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) (x - 0 && mask 14 >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20)\<rbrakk> \<Longrightarrow> False
 2. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr High_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr High_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr High_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 6. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr High_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr High_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range High_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr High_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> High_pd_ptr \<le> x \<and> x \<le> 0x3FFF + High_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 2. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (6 subgoals):
 1. \<And>x. \<lbrakk>High_pd_ptr \<le> x; x \<le> 0x3FFF + High_pd_ptr; UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2) = 0; ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range High_pd_ptr; is_aligned x 2; x && mask 14 = 0x3FC0\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<lbrakk>High_pd_ptr \<le> x; x \<le> 0x3FFF + High_pd_ptr; UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range High_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0\<rbrakk> \<Longrightarrow> False
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 6. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (7 subgoals):
 1. \<And>x. \<lbrakk>High_pd_ptr \<le> x; x \<le> 0x3FFF + High_pd_ptr; UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2) = 0; ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range High_pd_ptr; is_aligned x 2; x && mask 14 = 0x3FC0\<rbrakk> \<Longrightarrow> LENGTH(12) \<le> 12
 2. \<And>x. \<lbrakk>High_pd_ptr \<le> x; x \<le> 0x3FFF + High_pd_ptr; UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2) = 0; ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range High_pd_ptr; is_aligned x 2; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) ((x - High_pd_ptr >> 2) && mask 12) = UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)\<rbrakk> \<Longrightarrow> False
 3. \<And>x. \<lbrakk>High_pd_ptr \<le> x; x \<le> 0x3FFF + High_pd_ptr; UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range High_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0\<rbrakk> \<Longrightarrow> False
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 6. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 7. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (6 subgoals):
 1. \<And>x. \<lbrakk>High_pd_ptr \<le> x; x \<le> 0x3FFF + High_pd_ptr; UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2) = 0; ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range High_pd_ptr; is_aligned x 2; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) ((x - High_pd_ptr >> 2) && mask 12) = UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<lbrakk>High_pd_ptr \<le> x; x \<le> 0x3FFF + High_pd_ptr; UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range High_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0\<rbrakk> \<Longrightarrow> False
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 6. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (6 subgoals):
 1. \<And>x. \<lbrakk>High_pd_ptr \<le> x; x \<le> 0x3FFF + High_pd_ptr; UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2) = 0; ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range High_pd_ptr; is_aligned x 2; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) (x - High_pd_ptr && mask (12 + 2) >> 2) = UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<lbrakk>High_pd_ptr \<le> x; x \<le> 0x3FFF + High_pd_ptr; UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range High_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0\<rbrakk> \<Longrightarrow> False
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 6. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (6 subgoals):
 1. \<And>x. \<lbrakk>High_pd_ptr \<le> x; x \<le> 0x3FFF + High_pd_ptr; UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2) = 0; ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range High_pd_ptr; is_aligned x 2; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) (x - High_pd_ptr && mask 14 >> 2) = 0\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<lbrakk>High_pd_ptr \<le> x; x \<le> 0x3FFF + High_pd_ptr; UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range High_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0\<rbrakk> \<Longrightarrow> False
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 6. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (6 subgoals):
 1. \<And>x. \<lbrakk>High_pd_ptr \<le> x; x \<le> 0x3FFF + High_pd_ptr; UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2) = 0; ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range High_pd_ptr; is_aligned x 2; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) (x - (High_pd_ptr && mask 14) && mask 14 >> 2) = 0\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<lbrakk>High_pd_ptr \<le> x; x \<le> 0x3FFF + High_pd_ptr; UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range High_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0\<rbrakk> \<Longrightarrow> False
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 6. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (7 subgoals):
 1. \<And>x. \<lbrakk>High_pd_ptr \<le> x; x \<le> 0x3FFF + High_pd_ptr; UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2) = 0; ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range High_pd_ptr; is_aligned x 2; x && mask 14 = 0x3FC0\<rbrakk> \<Longrightarrow> is_aligned High_pd_ptr 14
 2. \<And>x. \<lbrakk>High_pd_ptr \<le> x; x \<le> 0x3FFF + High_pd_ptr; UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2) = 0; ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range High_pd_ptr; is_aligned x 2; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) (x - 0 && mask 14 >> 2) = 0\<rbrakk> \<Longrightarrow> False
 3. \<And>x. \<lbrakk>High_pd_ptr \<le> x; x \<le> 0x3FFF + High_pd_ptr; UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range High_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0\<rbrakk> \<Longrightarrow> False
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 6. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 7. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (6 subgoals):
 1. \<And>x. \<lbrakk>High_pd_ptr \<le> x; x \<le> 0x3FFF + High_pd_ptr; UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2) = 0; ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range High_pd_ptr; is_aligned x 2; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) (x - 0 && mask 14 >> 2) = 0\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<lbrakk>High_pd_ptr \<le> x; x \<le> 0x3FFF + High_pd_ptr; UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range High_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0\<rbrakk> \<Longrightarrow> False
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 6. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>x. \<lbrakk>High_pd_ptr \<le> x; x \<le> 0x3FFF + High_pd_ptr; UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range High_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0\<rbrakk> \<Longrightarrow> False
 2. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (6 subgoals):
 1. \<And>x. \<lbrakk>High_pd_ptr \<le> x; x \<le> 0x3FFF + High_pd_ptr; UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range High_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0\<rbrakk> \<Longrightarrow> LENGTH(12) \<le> 12
 2. \<And>x. \<lbrakk>High_pd_ptr \<le> x; x \<le> 0x3FFF + High_pd_ptr; UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range High_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) ((x - High_pd_ptr >> 2) && mask 12) = UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)\<rbrakk> \<Longrightarrow> False
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 6. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>x. \<lbrakk>High_pd_ptr \<le> x; x \<le> 0x3FFF + High_pd_ptr; UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range High_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) ((x - High_pd_ptr >> 2) && mask 12) = UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)\<rbrakk> \<Longrightarrow> False
 2. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>x. \<lbrakk>High_pd_ptr \<le> x; x \<le> 0x3FFF + High_pd_ptr; UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range High_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) (x - High_pd_ptr && mask (12 + 2) >> 2) = UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2)\<rbrakk> \<Longrightarrow> False
 2. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>x. \<lbrakk>High_pd_ptr \<le> x; x \<le> 0x3FFF + High_pd_ptr; UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range High_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) (x - High_pd_ptr && mask 14 >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20)\<rbrakk> \<Longrightarrow> False
 2. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>x. \<lbrakk>High_pd_ptr \<le> x; x \<le> 0x3FFF + High_pd_ptr; UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range High_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) (x - (High_pd_ptr && mask 14) && mask 14 >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20)\<rbrakk> \<Longrightarrow> False
 2. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (6 subgoals):
 1. \<And>x. \<lbrakk>High_pd_ptr \<le> x; x \<le> 0x3FFF + High_pd_ptr; UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range High_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0\<rbrakk> \<Longrightarrow> is_aligned High_pd_ptr 14
 2. \<And>x. \<lbrakk>High_pd_ptr \<le> x; x \<le> 0x3FFF + High_pd_ptr; UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range High_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) (x - 0 && mask 14 >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20)\<rbrakk> \<Longrightarrow> False
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 6. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>x. \<lbrakk>High_pd_ptr \<le> x; x \<le> 0x3FFF + High_pd_ptr; UCAST(32 \<rightarrow> 12) (x - High_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range High_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) (x - 0 && mask 14 >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20)\<rbrakk> \<Longrightarrow> False
 2. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (4 subgoals):
 1. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None)))) s0H_internal; x \<in> pd_offs_range Low_pd_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPDE (if x = 0 then ARM_H.PageTablePDE (addrFromPPtr Low_pt_ptr) False undefined else if x = UCAST(32 \<rightarrow> 12) (kernel_base >> 20) then ARM_H.SectionPDE (addrFromPPtr kernel_base) False 0 False False False (vmrights_map {}) else ARM_H.InvalidPDE))) (if is_aligned x 2 \<and> Low_pd_ptr \<le> x \<and> x \<le> 0x3FFF + Low_pd_ptr then Some (UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 2. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>x. \<lbrakk>Low_pd_ptr \<le> x; x \<le> 0x3FFF + Low_pd_ptr; UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2) = 0; ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range Low_pd_ptr; is_aligned x 2; x && mask 14 = 0x3FC0\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<lbrakk>Low_pd_ptr \<le> x; x \<le> 0x3FFF + Low_pd_ptr; UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range Low_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0\<rbrakk> \<Longrightarrow> False
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (6 subgoals):
 1. \<And>x. \<lbrakk>Low_pd_ptr \<le> x; x \<le> 0x3FFF + Low_pd_ptr; UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2) = 0; ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range Low_pd_ptr; is_aligned x 2; x && mask 14 = 0x3FC0\<rbrakk> \<Longrightarrow> LENGTH(12) \<le> 12
 2. \<And>x. \<lbrakk>Low_pd_ptr \<le> x; x \<le> 0x3FFF + Low_pd_ptr; UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2) = 0; ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range Low_pd_ptr; is_aligned x 2; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) ((x - Low_pd_ptr >> 2) && mask 12) = UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)\<rbrakk> \<Longrightarrow> False
 3. \<And>x. \<lbrakk>Low_pd_ptr \<le> x; x \<le> 0x3FFF + Low_pd_ptr; UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range Low_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0\<rbrakk> \<Longrightarrow> False
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 6. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>x. \<lbrakk>Low_pd_ptr \<le> x; x \<le> 0x3FFF + Low_pd_ptr; UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2) = 0; ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range Low_pd_ptr; is_aligned x 2; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) ((x - Low_pd_ptr >> 2) && mask 12) = UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<lbrakk>Low_pd_ptr \<le> x; x \<le> 0x3FFF + Low_pd_ptr; UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range Low_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0\<rbrakk> \<Longrightarrow> False
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>x. \<lbrakk>Low_pd_ptr \<le> x; x \<le> 0x3FFF + Low_pd_ptr; UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2) = 0; ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range Low_pd_ptr; is_aligned x 2; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr && mask (12 + 2) >> 2) = UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<lbrakk>Low_pd_ptr \<le> x; x \<le> 0x3FFF + Low_pd_ptr; UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range Low_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0\<rbrakk> \<Longrightarrow> False
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>x. \<lbrakk>Low_pd_ptr \<le> x; x \<le> 0x3FFF + Low_pd_ptr; UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2) = 0; ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range Low_pd_ptr; is_aligned x 2; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr && mask 14 >> 2) = 0\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<lbrakk>Low_pd_ptr \<le> x; x \<le> 0x3FFF + Low_pd_ptr; UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range Low_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0\<rbrakk> \<Longrightarrow> False
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>x. \<lbrakk>Low_pd_ptr \<le> x; x \<le> 0x3FFF + Low_pd_ptr; UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2) = 0; ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range Low_pd_ptr; is_aligned x 2; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) (x - (Low_pd_ptr && mask 14) && mask 14 >> 2) = 0\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<lbrakk>Low_pd_ptr \<le> x; x \<le> 0x3FFF + Low_pd_ptr; UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range Low_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0\<rbrakk> \<Longrightarrow> False
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (6 subgoals):
 1. \<And>x. \<lbrakk>Low_pd_ptr \<le> x; x \<le> 0x3FFF + Low_pd_ptr; UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2) = 0; ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range Low_pd_ptr; is_aligned x 2; x && mask 14 = 0x3FC0\<rbrakk> \<Longrightarrow> is_aligned Low_pd_ptr 14
 2. \<And>x. \<lbrakk>Low_pd_ptr \<le> x; x \<le> 0x3FFF + Low_pd_ptr; UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2) = 0; ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range Low_pd_ptr; is_aligned x 2; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) (x - 0 && mask 14 >> 2) = 0\<rbrakk> \<Longrightarrow> False
 3. \<And>x. \<lbrakk>Low_pd_ptr \<le> x; x \<le> 0x3FFF + Low_pd_ptr; UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range Low_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0\<rbrakk> \<Longrightarrow> False
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 6. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>x. \<lbrakk>Low_pd_ptr \<le> x; x \<le> 0x3FFF + Low_pd_ptr; UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2) = 0; ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range Low_pd_ptr; is_aligned x 2; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) (x - 0 && mask 14 >> 2) = 0\<rbrakk> \<Longrightarrow> False
 2. \<And>x. \<lbrakk>Low_pd_ptr \<le> x; x \<le> 0x3FFF + Low_pd_ptr; UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range Low_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0\<rbrakk> \<Longrightarrow> False
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (4 subgoals):
 1. \<And>x. \<lbrakk>Low_pd_ptr \<le> x; x \<le> 0x3FFF + Low_pd_ptr; UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range Low_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0\<rbrakk> \<Longrightarrow> False
 2. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>x. \<lbrakk>Low_pd_ptr \<le> x; x \<le> 0x3FFF + Low_pd_ptr; UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range Low_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0\<rbrakk> \<Longrightarrow> LENGTH(12) \<le> 12
 2. \<And>x. \<lbrakk>Low_pd_ptr \<le> x; x \<le> 0x3FFF + Low_pd_ptr; UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range Low_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) ((x - Low_pd_ptr >> 2) && mask 12) = UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)\<rbrakk> \<Longrightarrow> False
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (4 subgoals):
 1. \<And>x. \<lbrakk>Low_pd_ptr \<le> x; x \<le> 0x3FFF + Low_pd_ptr; UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range Low_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) ((x - Low_pd_ptr >> 2) && mask 12) = UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)\<rbrakk> \<Longrightarrow> False
 2. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (4 subgoals):
 1. \<And>x. \<lbrakk>Low_pd_ptr \<le> x; x \<le> 0x3FFF + Low_pd_ptr; UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range Low_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr && mask (12 + 2) >> 2) = UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2)\<rbrakk> \<Longrightarrow> False
 2. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (4 subgoals):
 1. \<And>x. \<lbrakk>Low_pd_ptr \<le> x; x \<le> 0x3FFF + Low_pd_ptr; UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range Low_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr && mask 14 >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20)\<rbrakk> \<Longrightarrow> False
 2. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (4 subgoals):
 1. \<And>x. \<lbrakk>Low_pd_ptr \<le> x; x \<le> 0x3FFF + Low_pd_ptr; UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range Low_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) (x - (Low_pd_ptr && mask 14) && mask 14 >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20)\<rbrakk> \<Longrightarrow> False
 2. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (5 subgoals):
 1. \<And>x. \<lbrakk>Low_pd_ptr \<le> x; x \<le> 0x3FFF + Low_pd_ptr; UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range Low_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0\<rbrakk> \<Longrightarrow> is_aligned Low_pd_ptr 14
 2. \<And>x. \<lbrakk>Low_pd_ptr \<le> x; x \<le> 0x3FFF + Low_pd_ptr; UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range Low_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) (x - 0 && mask 14 >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20)\<rbrakk> \<Longrightarrow> False
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 5. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (4 subgoals):
 1. \<And>x. \<lbrakk>Low_pd_ptr \<le> x; x \<le> 0x3FFF + Low_pd_ptr; UCAST(32 \<rightarrow> 12) (x - Low_pd_ptr >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20); ps_clear x 2 s0H_internal; 1 \<le> maxDomain; x \<in> pd_offs_range Low_pd_ptr; is_aligned x 2; UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<noteq> 0; x && mask 14 = 0x3FC0; UCAST(32 \<rightarrow> 12) (x - 0 && mask 14 >> 2) = UCAST(32 \<rightarrow> 12) (kernel_base >> 20)\<rbrakk> \<Longrightarrow> False
 2. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 3. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 4. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (3 subgoals):
 1. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range High_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (High_pt'H x))) (if is_aligned x 2 \<and> High_pt_ptr \<le> x \<and> x \<le> 0x3FF + High_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - High_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 2. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 3. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. \<And>x pde. \<lbrakk>1 \<le> maxDomain; is_aligned x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))); ps_clear x (objBitsKO (the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None)))) s0H_internal; x \<in> pt_offs_range Low_pt_ptr \<and> (\<exists>y. (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None) = Some y) \<and> KOArch (KOPDE pde) = the (map_option (\<lambda>x. KOArch (KOPTE (Low_pt'H x))) (if is_aligned x 2 \<and> Low_pt_ptr \<le> x \<and> x \<le> 0x3FF + Low_pt_ptr then Some (UCAST(32 \<rightarrow> 8) (x - Low_pt_ptr >> 2)) else None))\<rbrakk> \<Longrightarrow> valid_pde_mapping' (x && mask pdBits) pde
 2. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal \<and> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> pspace_domain_valid s0H_internal
 2. 1 \<le> maxDomain \<Longrightarrow> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> ksCurDomain s0H_internal \<le> maxDomain \<and> ksDomSchedule s0H_internal \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s0H_internal). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s0H_internal = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s0H_internal < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s0H_internal \<and> cur_tcb' s0H_internal proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> [(0, 0xA), (1, 0xA)] = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> [] \<and> cur_tcb' \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = init_globals_frame then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(Low_cnode_ptr \<mapsto> 10, High_cnode_ptr \<mapsto> 10, Silc_cnode_ptr \<mapsto> 10, irq_cnode_ptr \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = Low_tcb_ptr, ksIdleThread = idle_tcb_ptr, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState init_irq_node_ptr ((\<lambda>_. irqstate.IRQInactive)(timer_irq := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = arch_state0H, ksMachineState = machine_state0\<rparr> proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> cur_tcb' \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = init_globals_frame then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(Low_cnode_ptr \<mapsto> 10, High_cnode_ptr \<mapsto> 10, Silc_cnode_ptr \<mapsto> 10, irq_cnode_ptr \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = Low_tcb_ptr, ksIdleThread = idle_tcb_ptr, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState init_irq_node_ptr ((\<lambda>_. irqstate.IRQInactive)(timer_irq := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = arch_state0H, ksMachineState = machine_state0\<rparr> proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> ps_clear Low_tcb_ptr 9 \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = init_globals_frame then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(Low_cnode_ptr \<mapsto> 10, High_cnode_ptr \<mapsto> 10, Silc_cnode_ptr \<mapsto> 10, irq_cnode_ptr \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = Low_tcb_ptr, ksIdleThread = idle_tcb_ptr, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState init_irq_node_ptr ((\<lambda>_. irqstate.IRQInactive)(timer_irq := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = arch_state0H, ksMachineState = machine_state0\<rparr> proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> \<exists>v. ksPSpace \<lparr>ksPSpace = kh0H, gsUserPages = \<lambda>x. if x = init_globals_frame then Some ARMSmallPage else None, gsCNodes = (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some 0 else None)(Low_cnode_ptr \<mapsto> 10, High_cnode_ptr \<mapsto> 10, Silc_cnode_ptr \<mapsto> 10, irq_cnode_ptr \<mapsto> 0), gsUntypedZeroRanges = ran (untypedZeroRange \<circ>\<^sub>m (map_option cteCap \<circ> map_to_ctes kh0H)), gsMaxObjectSize = CARD(32 word), ksDomScheduleIdx = 0, ksDomSchedule = [(0, 0xA), (1, 0xA)], ksCurDomain = 0, ksDomainTime = 5, ksReadyQueues = const [], ksReadyQueuesL1Bitmap = const 0, ksReadyQueuesL2Bitmap = const 0, ksCurThread = Low_tcb_ptr, ksIdleThread = idle_tcb_ptr, ksSchedulerAction = ResumeCurrentThread, ksInterruptState = InterruptState init_irq_node_ptr ((\<lambda>_. irqstate.IRQInactive)(timer_irq := irqstate.IRQTimer)), ksWorkUnitsCompleted = undefined, ksArchState = arch_state0H, ksMachineState = machine_state0\<rparr> Low_tcb_ptr = Some v \<and> objBitsKO v = 9 proof (prove)
goal:
No subgoals!