theory Example_Valid_StateH

lemma map_to_ctes_kh0H:
  "map_to_ctes kh0H =
          (option_update_range
           (\<lambda>x. if \<exists>irq::10 word. init_irq_node_ptr + (ucast irq << cte_level_bits) = x
                then Some (CTE NullCap Null_mdb) else None) \<circ>
          option_update_range (Low_cte_cte Low_cnode_ptr) \<circ>
          option_update_range (High_cte_cte High_cnode_ptr) \<circ>
          option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ>
          option_update_range [irq_cnode_ptr \<mapsto> CTE NullCap Null_mdb] \<circ>
          option_update_range Low_tcb_cte \<circ>
          option_update_range High_tcb_cte \<circ>
          option_update_range idle_tcb_cte
          ) Map.empty" supply option.case_cong[cong] if_cong[cong] supply objBits_defs[simp] apply (rule ext) apply (case_tac "kh0H x") apply (clarsimp simp add: map_to_ctes_def Let_def objBitsKO_def) apply (rule conjI) apply clarsimp apply (thin_tac "x \<inter> y = {}" for x y) apply (frule kh0H_dom_tcb) apply (elim disjE) apply (clarsimp simp: option_update_range_def) apply (frule mask_in_tcb_offs_range) apply (clarsimp simp: kh0H_dom_distinct[THEN set_mem_neq]) apply (simp add: kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None
            | simp add: kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None)+ apply (rule conjI, clarsimp) apply (clarsimp split: option.splits) apply (rule conjI) apply (fastforce simp: tcb_cte_cases_def Low_tcb_cte_def dest: neg_mask_decompose) apply clarsimp subgoal by (fastforce simp: Low_tcb_cte_def tcb_cte_cases_def split: if_split_asm dest: neg_mask_decompose) apply (clarsimp simp: option_update_range_def) apply (frule mask_in_tcb_offs_range) apply (clarsimp simp: kh0H_dom_distinct[THEN set_mem_neq]) apply (simp add: kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None
           | simp add: kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None)+ apply (rule conjI, clarsimp) apply clarsimp apply (clarsimp split: option.splits) apply (rule conjI) apply (fastforce simp: tcb_cte_cases_def High_tcb_cte_def dest: neg_mask_decompose) apply clarsimp apply (fastforce simp: High_tcb_cte_def tcb_cte_cases_def split: if_split_asm dest: neg_mask_decompose) apply (clarsimp simp: option_update_range_def) apply (frule mask_in_tcb_offs_range) apply (clarsimp simp: kh0H_dom_distinct[THEN set_mem_neq]) apply (simp add: kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None
          | simp add: kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None)+ apply (rule conjI, clarsimp) apply clarsimp apply (clarsimp split: option.splits) apply (rule conjI) apply (fastforce simp: tcb_cte_cases_def idle_tcb_cte_def dest: neg_mask_decompose) apply clarsimp apply (fastforce simp: idle_tcb_cte_def tcb_cte_cases_def split: if_split_asm dest: neg_mask_decompose) apply (drule_tac m="kh0H" in opt_None_not_dom) apply (rule conjI) apply (clarsimp simp: kh0H_dom option_update_range_def) apply ((clarsimp simp: kh0H_dom_sets_distinct[THEN orthD2] not_in_tcb_offs not_in_range_cte_None offs_in_range
          | clarsimp simp: kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None)+)[1] apply (rule impI) apply (frule range_tcb_not_kh0H_dom(1)[simplified]) apply (frule range_tcb_not_kh0H_dom(2)[simplified]) apply (drule range_tcb_not_kh0H_dom(3)[simplified]) apply (clarsimp simp: kh0H_dom split del: if_split) apply (clarsimp simp: option_update_range_def) apply ((clarsimp simp: kh0H_dom_sets_distinct[THEN orthD2] not_in_tcb_offs not_in_range_cte_None offs_in_range
         | clarsimp simp: kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None)+)[1] apply (subst not_in_range_cte_None,
          clarsimp simp: tcb_offs_range_mask_eq s0_ptrs_aligned)+ apply (clarsimp simp: irq_node_offs_in_range) apply (frule kh0H_SomeD) apply (elim disjE) apply (clarsimp simp: map_to_ctes_def Let_def kh0H_obj_def split del: if_split,
          subst if_split_eq1,
          rule conjI,
           clarsimp,
           drule kh0H_dom_tcb,
           fastforce simp: s0_ptr_defs mask_def objBitsKO_def,
          rule impI,
          fastforce simp: option_update_range_def kh0H_dom_distinct not_in_range_cte_None) apply ((clarsimp simp: map_to_ctes_def Let_def split del: if_split,
          subst if_split_eq1,
          rule conjI,
           rule impI,
           (subst is_aligned_neg_mask_eq,
            simp add: is_aligned_def s0_ptr_defs objBitsKO_def)+,
           ((clarsimp simp: option_update_range_def kh0H_dom_distinct not_in_range_cte_None |
             clarsimp simp: idle_tcb_cte_def High_tcb_cte_def Low_tcb_cte_def)+)[1],
          rule impI,
          (subst(asm) is_aligned_neg_mask_eq,
           simp add: is_aligned_def s0_ptr_defs objBitsKO_def)+,
          clarsimp,
          clarsimp simp: s0_ptr_defs cnode_offs_range_def pd_offs_range_def pt_offs_range_def irq_node_offs_range_def objBitsKO_def kh0H_dom,
          rule FalseE,
          drule int_not_emptyD,
          clarsimp,
          (elim disjE, (clarsimp | drule(1) order_trans le_less_trans, fastforce)+)[1])+)[3] apply (clarsimp simp: map_to_ctes_def Let_def kh0H_obj_def split del: if_split,
          subst if_split_eq1,
          rule conjI,
           clarsimp,
           drule kh0H_dom_tcb,
           fastforce simp: s0_ptr_defs mask_def objBitsKO_def,
          rule impI,
          fastforce simp: option_update_range_def kh0H_dom_distinct not_in_range_cte_None) apply (clarsimp simp: map_to_ctes_def Let_def kh0H_obj_def split del: if_split,
          subst if_split_eq1,
          rule conjI,
           rule impI,
           clarsimp simp: option_update_range_def kh0H_dom_distinct not_in_range_cte_None,
          rule impI,
          clarsimp simp: s0_ptr_defs cnode_offs_range_def pd_offs_range_def pt_offs_range_def irq_node_offs_range_def objBitsKO_def kh0H_dom is_aligned_def,
          rule FalseE,
          drule int_not_emptyD,
          clarsimp,
          (elim disjE, (clarsimp | drule(1) order_trans le_less_trans, fastforce)+)[1]) apply (clarsimp simp: map_to_ctes_def Let_def kh0H_obj_def split del: if_split) apply (frule irq_node_offs_range_correct) apply (subst if_split_eq1) apply (rule conjI) apply (rule impI) apply (clarsimp simp: option_update_range_def kh0H_dom_distinct not_in_range_cte_None) apply fastforce apply (rule impI) apply clarsimp apply (erule impE) apply (rule is_aligned_add) apply (simp add: is_aligned_def s0_ptr_defs objBitsKO_def) apply (rule is_aligned_shiftl) apply (clarsimp simp: objBitsKO_def cte_level_bits_def) apply (rule FalseE) apply (clarsimp simp: s0_ptr_defs cnode_offs_range_def pd_offs_range_def pt_offs_range_def irq_node_offs_range_def objBitsKO_def kh0H_dom cte_level_bits_def) apply (cut_tac x=irq and 'a=32 in ucast_less) apply simp apply (drule shiftl_less_t2n'[where n=4]) apply simp apply simp apply (drule plus_one_helper[where n="0x3FFF", simplified]) apply (elim disjE) apply (unat_arith+)[6] apply (drule int_not_emptyD) apply clarsimp apply (elim disjE,
          ((clarsimp,
           drule(1) aligned_le_sharp,
           clarsimp simp: add.commute,
           subst(asm) mask_out_add_aligned[symmetric],
            simp add: is_aligned_shiftl,
           simp add: mask_def,
           drule word_leq_le_minus_one,
            subst add.commute,
            rule neq_0_no_wrap,
             erule word_plus_mono_right2[rotated],
             fastforce,
            fastforce,
           fastforce simp: add.commute)
           | unat_arith)+)[1] apply ((clarsimp simp: map_to_ctes_def Let_def kh0H_obj_def objBitsKO_def split: if_split_asm split del: if_split,
          subst if_split_eq1,
          rule conjI,
           rule impI,
           clarsimp simp: option_update_range_def kh0H_dom_distinct not_in_range_cte_None,
           (clarsimp simp: option_update_range_def kh0H_dom_distinct[THEN set_mem_neq] kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None | simp add: kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None)+,
           rule conjI,
            clarsimp,
           drule offs_range_correct,
           fastforce simp: Low_cte_cte_def High_cte_cte_def Silc_cte_cte_def,
          rule impI,
          rule FalseE,
          clarsimp,
          drule offs_range_correct,
          clarsimp simp: Low_cte_def High_cte_def Silc_cte_def cte_level_bits_def cnode_offs_min cnode_offs_max,
          cut_tac x="of_bl y" and z="0x10::word32" and y="2 ^ 14 - 1" in div_to_mult_word_lt,
           frule_tac 'a=32 in of_bl_length_le,
            simp,
           simp,
          drule int_not_emptyD,
          clarsimp simp: kh0H_dom s0_ptr_defs cnode_offs_range_def pd_offs_range_def pt_offs_range_def irq_node_offs_range_def cte_level_bits_def,
          (elim disjE,
           (clarsimp simp: s0_ptr_defs,
           drule_tac b="x + y * 0x10" and n=4 for x y in aligned_le_sharp,
            fastforce simp: is_aligned_def,
           clarsimp simp: add.commute,
           subst(asm) mask_out_add_aligned[symmetric],
            simp add: is_aligned_mult_triv2[where n=4, simplified],
           simp add: mask_def,
           drule word_leq_le_minus_one,
            subst add.commute,
            rule neq_0_no_wrap,
             erule word_plus_mono_right2[rotated],
             fastforce,
            fastforce,
           fastforce simp: add.commute | unat_arith)+)[1])+)[3] apply ((clarsimp simp: map_to_ctes_def Let_def split del: if_split,
          subst if_split_eq1,
          rule conjI,
           rule impI,
           drule pd_offs_range_correct,
           clarsimp simp: option_update_range_def kh0H_dom_distinct not_in_range_cte_None kh0H_obj_def,
          rule impI,
          subst if_split_eq1,
          rule conjI,
           rule impI,
           rule FalseE,
           drule pd_offs_range_correct,
           clarsimp,
           cut_tac x=ya and 'a=32 in ucast_less,
            simp,
           drule shiftl_less_t2n'[where n=2],
            simp,
           simp,
           drule plus_one_helper[where n="0x3FFF", simplified],
           drule kh0H_dom_tcb,
           (elim disjE,
             (clarsimp simp: s0_ptr_defs objBitsKO_def,
             erule notE[rotated],
             rule_tac x="x::word32" for x in gt_imp_neq,
             rule less_le_trans[rotated, OF aligned_le_sharp],
               erule word_plus_mono_right2[rotated],
               simp,
              simp add: is_aligned_def,
             simp)+)[1],
          rule impI,
          clarsimp simp: option_update_range_def kh0H_dom_distinct[THEN set_mem_neq] not_in_range_cte_None,
          ((clarsimp simp: kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None irq_node_offs_in_range |
          clarsimp simp: kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None)+)[1])+)[3] by (clarsimp simp: map_to_ctes_def Let_def split del: if_split,
          subst if_split_eq1,
          rule conjI,
           rule impI,
           drule pt_offs_range_correct,
           clarsimp simp: option_update_range_def kh0H_dom_distinct not_in_range_cte_None kh0H_obj_def,
          rule impI,
          subst if_split_eq1,
          rule conjI,
           rule impI,
           rule FalseE,
           drule pt_offs_range_correct,
           clarsimp,
           cut_tac x=ya and 'a=32 in ucast_less,
            simp,
           drule shiftl_less_t2n'[where n=2],
            simp,
           simp,
           drule plus_one_helper[where n="0x3FF", simplified],
           drule kh0H_dom_tcb,
           elim disjE,
             ((clarsimp simp: s0_ptr_defs objBitsKO_def,
             erule notE[rotated],
             rule_tac x="x::word32" for x in gt_imp_neq,
             rule less_le_trans[rotated, OF aligned_le_sharp],
               erule word_plus_mono_right2[rotated],
               fastforce,
              fastforce simp: is_aligned_def,
             fastforce)+)[2],
           clarsimp simp: s0_ptr_defs objBitsKO_def,
           erule notE[rotated],
            rule_tac x="x::word32" for x in less_imp_neq,
           rule le_less_trans[OF mask_neg_le],
           unat_arith,
          rule impI,
          clarsimp simp: option_update_range_def kh0H_dom_distinct[THEN set_mem_neq] not_in_range_cte_None,
          ((clarsimp simp: kh0H_dom_sets_distinct[THEN orthD1] not_in_range_cte_None irq_node_offs_in_range |
          clarsimp simp: kh0H_dom_sets_distinct[THEN orthD2] not_in_range_cte_None)+)[1])+

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. map_to_ctes kh0H = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) proof (prove)
goal (1 subgoal):
 1. map_to_ctes kh0H = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) proof (prove)
goal (1 subgoal):
 1. map_to_ctes kh0H = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) proof (prove)
goal (1 subgoal):
 1. \<And>x. map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (2 subgoals):
 1. \<And>x. kh0H x = None \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 2. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (2 subgoals):
 1. \<And>x. kh0H x = None \<Longrightarrow> ((\<exists>tcb. kh0H (x && ~~ mask 9) = Some (KOTCB tcb)) \<and> {(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H = {} \<longrightarrow> (case kh0H (x && ~~ mask 9) of Some (KOTCB tcb) \<Rightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x - (x && ~~ mask 9)))) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 2. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (3 subgoals):
 1. \<And>x. kh0H x = None \<Longrightarrow> (\<exists>tcb. kh0H (x && ~~ mask 9) = Some (KOTCB tcb)) \<and> {(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H = {} \<longrightarrow> (case kh0H (x && ~~ mask 9) of Some (KOTCB tcb) \<Rightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x - (x && ~~ mask 9)))) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 2. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 3. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (3 subgoals):
 1. \<And>x tcb. \<lbrakk>kh0H x = None; {(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H = {}; kh0H (x && ~~ mask 9) = Some (KOTCB tcb)\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 2. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 3. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (3 subgoals):
 1. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb)\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 2. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 3. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (3 subgoals):
 1. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = Low_tcb_ptr \<or> x && ~~ mask 9 = High_tcb_ptr \<or> x && ~~ mask 9 = idle_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 2. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 3. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (5 subgoals):
 1. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = Low_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 2. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = High_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 3. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = idle_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 4. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 5. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (5 subgoals):
 1. \<And>x. \<lbrakk>kh0H x = None; x && ~~ mask 9 = Low_tcb_ptr\<rbrakk> \<Longrightarrow> (x = irq_cnode_ptr \<longrightarrow> map_option (\<lambda>(getF, setF). getF Low_tcbH) (tcb_cte_cases (irq_cnode_ptr && mask 9)) = (case Low_cte_cte Low_cnode_ptr irq_cnode_ptr of None \<Rightarrow> case High_cte_cte High_cnode_ptr irq_cnode_ptr of None \<Rightarrow> case Silc_cte_cte Silc_cnode_ptr irq_cnode_ptr of None \<Rightarrow> Some (CTE capability.NullCap (MDB 0 0 False False)) | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2)) \<and> (x \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x) \<longrightarrow> (\<exists>a. (\<exists>b. tcb_cte_cases (x && mask 9) = Some (a, b)) \<and> a Low_tcbH = CTE capability.NullCap (MDB 0 0 False False))) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x) \<longrightarrow> map_option (\<lambda>(getF, setF). getF Low_tcbH) (tcb_cte_cases (x && mask 9)) = (case Low_cte_cte Low_cnode_ptr x of None \<Rightarrow> case High_cte_cte High_cnode_ptr x of None \<Rightarrow> case Silc_cte_cte Silc_cnode_ptr x of None \<Rightarrow> case Low_tcb_cte x of None \<Rightarrow> case High_tcb_cte x of None \<Rightarrow> case idle_tcb_cte x of None \<Rightarrow> None | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2)))
 2. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = High_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 3. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = idle_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 4. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 5. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (5 subgoals):
 1. \<And>x. \<lbrakk>kh0H x = None; x && ~~ mask 9 = Low_tcb_ptr; x \<in> tcb_offs_range Low_tcb_ptr\<rbrakk> \<Longrightarrow> (x = irq_cnode_ptr \<longrightarrow> map_option (\<lambda>(getF, setF). getF Low_tcbH) (tcb_cte_cases (irq_cnode_ptr && mask 9)) = (case Low_cte_cte Low_cnode_ptr irq_cnode_ptr of None \<Rightarrow> case High_cte_cte High_cnode_ptr irq_cnode_ptr of None \<Rightarrow> case Silc_cte_cte Silc_cnode_ptr irq_cnode_ptr of None \<Rightarrow> Some (CTE capability.NullCap (MDB 0 0 False False)) | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2)) \<and> (x \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x) \<longrightarrow> (\<exists>a. (\<exists>b. tcb_cte_cases (x && mask 9) = Some (a, b)) \<and> a Low_tcbH = CTE capability.NullCap (MDB 0 0 False False))) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x) \<longrightarrow> map_option (\<lambda>(getF, setF). getF Low_tcbH) (tcb_cte_cases (x && mask 9)) = (case Low_cte_cte Low_cnode_ptr x of None \<Rightarrow> case High_cte_cte High_cnode_ptr x of None \<Rightarrow> case Silc_cte_cte Silc_cnode_ptr x of None \<Rightarrow> case Low_tcb_cte x of None \<Rightarrow> case High_tcb_cte x of None \<Rightarrow> case idle_tcb_cte x of None \<Rightarrow> None | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2)))
 2. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = High_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 3. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = idle_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 4. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 5. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (5 subgoals):
 1. \<And>x. \<lbrakk>kh0H x = None; x && ~~ mask 9 = Low_tcb_ptr; x \<in> tcb_offs_range Low_tcb_ptr\<rbrakk> \<Longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x) \<longrightarrow> (\<exists>a. (\<exists>b. tcb_cte_cases (x && mask 9) = Some (a, b)) \<and> a Low_tcbH = CTE capability.NullCap (MDB 0 0 False False))) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x) \<longrightarrow> map_option (\<lambda>(getF, setF). getF Low_tcbH) (tcb_cte_cases (x && mask 9)) = (case Low_cte_cte Low_cnode_ptr x of None \<Rightarrow> case High_cte_cte High_cnode_ptr x of None \<Rightarrow> case Silc_cte_cte Silc_cnode_ptr x of None \<Rightarrow> case Low_tcb_cte x of None \<Rightarrow> case High_tcb_cte x of None \<Rightarrow> case idle_tcb_cte x of None \<Rightarrow> None | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2))
 2. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = High_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 3. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = idle_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 4. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 5. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (5 subgoals):
 1. \<And>x. \<lbrakk>kh0H x = None; x && ~~ mask 9 = Low_tcb_ptr; x \<in> tcb_offs_range Low_tcb_ptr\<rbrakk> \<Longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x) \<longrightarrow> (\<exists>a. (\<exists>b. tcb_cte_cases (x && mask 9) = Some (a, b)) \<and> a Low_tcbH = CTE capability.NullCap (MDB 0 0 False False))) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x) \<longrightarrow> map_option (\<lambda>(getF, setF). getF Low_tcbH) (tcb_cte_cases (x && mask 9)) = (case Low_tcb_cte x of None \<Rightarrow> None | Some x2 \<Rightarrow> Some x2))
 2. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = High_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 3. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = idle_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 4. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 5. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (5 subgoals):
 1. \<And>x. \<lbrakk>kh0H x = None; x && ~~ mask 9 = Low_tcb_ptr; x \<in> tcb_offs_range Low_tcb_ptr\<rbrakk> \<Longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x) \<longrightarrow> map_option (\<lambda>(getF, setF). getF Low_tcbH) (tcb_cte_cases (x && mask 9)) = (case Low_tcb_cte x of None \<Rightarrow> None | Some x2 \<Rightarrow> Some x2)
 2. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = High_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 3. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = idle_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 4. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 5. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (5 subgoals):
 1. \<And>x. \<lbrakk>kh0H x = None; x && ~~ mask 9 = Low_tcb_ptr; x \<in> tcb_offs_range Low_tcb_ptr\<rbrakk> \<Longrightarrow> (Low_tcb_cte x = None \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x) \<longrightarrow> tcb_cte_cases (x && mask 9) = None) \<and> (\<forall>x2. Low_tcb_cte x = Some x2 \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x) \<longrightarrow> (\<exists>a. (\<exists>b. tcb_cte_cases (x && mask 9) = Some (a, b)) \<and> a Low_tcbH = x2))
 2. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = High_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 3. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = idle_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 4. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 5. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (6 subgoals):
 1. \<And>x. \<lbrakk>kh0H x = None; x && ~~ mask 9 = Low_tcb_ptr; x \<in> tcb_offs_range Low_tcb_ptr\<rbrakk> \<Longrightarrow> Low_tcb_cte x = None \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x) \<longrightarrow> tcb_cte_cases (x && mask 9) = None
 2. \<And>x. \<lbrakk>kh0H x = None; x && ~~ mask 9 = Low_tcb_ptr; x \<in> tcb_offs_range Low_tcb_ptr\<rbrakk> \<Longrightarrow> \<forall>x2. Low_tcb_cte x = Some x2 \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x) \<longrightarrow> (\<exists>a. (\<exists>b. tcb_cte_cases (x && mask 9) = Some (a, b)) \<and> a Low_tcbH = x2)
 3. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = High_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 4. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = idle_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 5. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 6. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (5 subgoals):
 1. \<And>x. \<lbrakk>kh0H x = None; x && ~~ mask 9 = Low_tcb_ptr; x \<in> tcb_offs_range Low_tcb_ptr\<rbrakk> \<Longrightarrow> \<forall>x2. Low_tcb_cte x = Some x2 \<longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x) \<longrightarrow> (\<exists>a. (\<exists>b. tcb_cte_cases (x && mask 9) = Some (a, b)) \<and> a Low_tcbH = x2)
 2. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = High_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 3. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = idle_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 4. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 5. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (5 subgoals):
 1. \<And>x x2. \<lbrakk>kh0H x = None; x && ~~ mask 9 = Low_tcb_ptr; x \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte x = Some x2; \<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x\<rbrakk> \<Longrightarrow> \<exists>a. (\<exists>b. tcb_cte_cases (x && mask 9) = Some (a, b)) \<and> a Low_tcbH = x2
 2. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = High_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 3. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = idle_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 4. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 5. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (1 subgoal):
 1. \<lbrakk>kh0H x_ = None; x_ && ~~ mask 9 = Low_tcb_ptr; x_ \<in> tcb_offs_range Low_tcb_ptr; Low_tcb_cte x_ = Some x2_; \<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x_\<rbrakk> \<Longrightarrow> \<exists>a. (\<exists>b. tcb_cte_cases (x_ && mask 9) = Some (a, b)) \<and> a Low_tcbH = x2_ proof (prove)
goal (4 subgoals):
 1. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = High_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 2. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = idle_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 3. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 4. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (4 subgoals):
 1. \<And>x. \<lbrakk>kh0H x = None; x && ~~ mask 9 = High_tcb_ptr\<rbrakk> \<Longrightarrow> (x = irq_cnode_ptr \<longrightarrow> map_option (\<lambda>(getF, setF). getF High_tcbH) (tcb_cte_cases (irq_cnode_ptr && mask 9)) = (case Low_cte_cte Low_cnode_ptr irq_cnode_ptr of None \<Rightarrow> case High_cte_cte High_cnode_ptr irq_cnode_ptr of None \<Rightarrow> case Silc_cte_cte Silc_cnode_ptr irq_cnode_ptr of None \<Rightarrow> Some (CTE capability.NullCap (MDB 0 0 False False)) | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2)) \<and> (x \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x) \<longrightarrow> (\<exists>a. (\<exists>b. tcb_cte_cases (x && mask 9) = Some (a, b)) \<and> a High_tcbH = CTE capability.NullCap (MDB 0 0 False False))) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x) \<longrightarrow> map_option (\<lambda>(getF, setF). getF High_tcbH) (tcb_cte_cases (x && mask 9)) = (case Low_cte_cte Low_cnode_ptr x of None \<Rightarrow> case High_cte_cte High_cnode_ptr x of None \<Rightarrow> case Silc_cte_cte Silc_cnode_ptr x of None \<Rightarrow> case Low_tcb_cte x of None \<Rightarrow> case High_tcb_cte x of None \<Rightarrow> case idle_tcb_cte x of None \<Rightarrow> None | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2)))
 2. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = idle_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 3. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 4. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (4 subgoals):
 1. \<And>x. \<lbrakk>kh0H x = None; x && ~~ mask 9 = High_tcb_ptr; x \<in> tcb_offs_range High_tcb_ptr\<rbrakk> \<Longrightarrow> (x = irq_cnode_ptr \<longrightarrow> map_option (\<lambda>(getF, setF). getF High_tcbH) (tcb_cte_cases (irq_cnode_ptr && mask 9)) = (case Low_cte_cte Low_cnode_ptr irq_cnode_ptr of None \<Rightarrow> case High_cte_cte High_cnode_ptr irq_cnode_ptr of None \<Rightarrow> case Silc_cte_cte Silc_cnode_ptr irq_cnode_ptr of None \<Rightarrow> Some (CTE capability.NullCap (MDB 0 0 False False)) | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2)) \<and> (x \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x) \<longrightarrow> (\<exists>a. (\<exists>b. tcb_cte_cases (x && mask 9) = Some (a, b)) \<and> a High_tcbH = CTE capability.NullCap (MDB 0 0 False False))) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x) \<longrightarrow> map_option (\<lambda>(getF, setF). getF High_tcbH) (tcb_cte_cases (x && mask 9)) = (case Low_cte_cte Low_cnode_ptr x of None \<Rightarrow> case High_cte_cte High_cnode_ptr x of None \<Rightarrow> case Silc_cte_cte Silc_cnode_ptr x of None \<Rightarrow> case Low_tcb_cte x of None \<Rightarrow> case High_tcb_cte x of None \<Rightarrow> case idle_tcb_cte x of None \<Rightarrow> None | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2)))
 2. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = idle_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 3. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 4. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (4 subgoals):
 1. \<And>x. \<lbrakk>kh0H x = None; x && ~~ mask 9 = High_tcb_ptr; x \<in> tcb_offs_range High_tcb_ptr\<rbrakk> \<Longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x) \<longrightarrow> (\<exists>a. (\<exists>b. tcb_cte_cases (x && mask 9) = Some (a, b)) \<and> a High_tcbH = CTE capability.NullCap (MDB 0 0 False False))) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x) \<longrightarrow> map_option (\<lambda>(getF, setF). getF High_tcbH) (tcb_cte_cases (x && mask 9)) = (case Low_cte_cte Low_cnode_ptr x of None \<Rightarrow> case High_cte_cte High_cnode_ptr x of None \<Rightarrow> case Silc_cte_cte Silc_cnode_ptr x of None \<Rightarrow> case Low_tcb_cte x of None \<Rightarrow> case High_tcb_cte x of None \<Rightarrow> case idle_tcb_cte x of None \<Rightarrow> None | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2))
 2. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = idle_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 3. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 4. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (4 subgoals):
 1. \<And>x. \<lbrakk>kh0H x = None; x && ~~ mask 9 = High_tcb_ptr; x \<in> tcb_offs_range High_tcb_ptr\<rbrakk> \<Longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x) \<longrightarrow> (\<exists>a. (\<exists>b. tcb_cte_cases (x && mask 9) = Some (a, b)) \<and> a High_tcbH = CTE capability.NullCap (MDB 0 0 False False))) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x) \<longrightarrow> map_option (\<lambda>(getF, setF). getF High_tcbH) (tcb_cte_cases (x && mask 9)) = (case High_tcb_cte x of None \<Rightarrow> None | Some x2 \<Rightarrow> Some x2))
 2. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = idle_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 3. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 4. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (4 subgoals):
 1. \<And>x. \<lbrakk>kh0H x = None; x && ~~ mask 9 = High_tcb_ptr; x \<in> tcb_offs_range High_tcb_ptr\<rbrakk> \<Longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x) \<longrightarrow> map_option (\<lambda>(getF, setF). getF High_tcbH) (tcb_cte_cases (x && mask 9)) = (case High_tcb_cte x of None \<Rightarrow> None | Some x2 \<Rightarrow> Some x2)
 2. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = idle_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 3. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 4. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (4 subgoals):
 1. \<And>x. \<lbrakk>kh0H x = None; x && ~~ mask 9 = High_tcb_ptr; x \<in> tcb_offs_range High_tcb_ptr; \<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF High_tcbH) (tcb_cte_cases (x && mask 9)) = (case High_tcb_cte x of None \<Rightarrow> None | Some x2 \<Rightarrow> Some x2)
 2. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = idle_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 3. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 4. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (4 subgoals):
 1. \<And>x. \<lbrakk>kh0H x = None; x && ~~ mask 9 = High_tcb_ptr; x \<in> tcb_offs_range High_tcb_ptr; \<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x\<rbrakk> \<Longrightarrow> (High_tcb_cte x = None \<longrightarrow> tcb_cte_cases (x && mask 9) = None) \<and> (\<forall>x2. High_tcb_cte x = Some x2 \<longrightarrow> (\<exists>a. (\<exists>b. tcb_cte_cases (x && mask 9) = Some (a, b)) \<and> a High_tcbH = x2))
 2. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = idle_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 3. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 4. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (5 subgoals):
 1. \<And>x. \<lbrakk>kh0H x = None; x && ~~ mask 9 = High_tcb_ptr; x \<in> tcb_offs_range High_tcb_ptr; \<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x\<rbrakk> \<Longrightarrow> High_tcb_cte x = None \<longrightarrow> tcb_cte_cases (x && mask 9) = None
 2. \<And>x. \<lbrakk>kh0H x = None; x && ~~ mask 9 = High_tcb_ptr; x \<in> tcb_offs_range High_tcb_ptr; \<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x\<rbrakk> \<Longrightarrow> \<forall>x2. High_tcb_cte x = Some x2 \<longrightarrow> (\<exists>a. (\<exists>b. tcb_cte_cases (x && mask 9) = Some (a, b)) \<and> a High_tcbH = x2)
 3. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = idle_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 4. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 5. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (4 subgoals):
 1. \<And>x. \<lbrakk>kh0H x = None; x && ~~ mask 9 = High_tcb_ptr; x \<in> tcb_offs_range High_tcb_ptr; \<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x\<rbrakk> \<Longrightarrow> \<forall>x2. High_tcb_cte x = Some x2 \<longrightarrow> (\<exists>a. (\<exists>b. tcb_cte_cases (x && mask 9) = Some (a, b)) \<and> a High_tcbH = x2)
 2. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = idle_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 3. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 4. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (4 subgoals):
 1. \<And>x x2. \<lbrakk>kh0H x = None; x && ~~ mask 9 = High_tcb_ptr; x \<in> tcb_offs_range High_tcb_ptr; \<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x; High_tcb_cte x = Some x2\<rbrakk> \<Longrightarrow> \<exists>a. (\<exists>b. tcb_cte_cases (x && mask 9) = Some (a, b)) \<and> a High_tcbH = x2
 2. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = idle_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 3. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 4. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (3 subgoals):
 1. \<And>x tcb. \<lbrakk>kh0H x = None; kh0H (x && ~~ mask 9) = Some (KOTCB tcb); x && ~~ mask 9 = idle_tcb_ptr\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x && mask 9)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 2. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 3. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>kh0H x = None; x && ~~ mask 9 = idle_tcb_ptr\<rbrakk> \<Longrightarrow> (x = irq_cnode_ptr \<longrightarrow> map_option (\<lambda>(getF, setF). getF idle_tcbH) (tcb_cte_cases (irq_cnode_ptr && mask 9)) = (case Low_cte_cte Low_cnode_ptr irq_cnode_ptr of None \<Rightarrow> case High_cte_cte High_cnode_ptr irq_cnode_ptr of None \<Rightarrow> case Silc_cte_cte Silc_cnode_ptr irq_cnode_ptr of None \<Rightarrow> Some (CTE capability.NullCap (MDB 0 0 False False)) | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2)) \<and> (x \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x) \<longrightarrow> (\<exists>a. (\<exists>b. tcb_cte_cases (x && mask 9) = Some (a, b)) \<and> a idle_tcbH = CTE capability.NullCap (MDB 0 0 False False))) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x) \<longrightarrow> map_option (\<lambda>(getF, setF). getF idle_tcbH) (tcb_cte_cases (x && mask 9)) = (case Low_cte_cte Low_cnode_ptr x of None \<Rightarrow> case High_cte_cte High_cnode_ptr x of None \<Rightarrow> case Silc_cte_cte Silc_cnode_ptr x of None \<Rightarrow> case Low_tcb_cte x of None \<Rightarrow> case High_tcb_cte x of None \<Rightarrow> case idle_tcb_cte x of None \<Rightarrow> None | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2)))
 2. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 3. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>kh0H x = None; x && ~~ mask 9 = idle_tcb_ptr; x \<in> tcb_offs_range idle_tcb_ptr\<rbrakk> \<Longrightarrow> (x = irq_cnode_ptr \<longrightarrow> map_option (\<lambda>(getF, setF). getF idle_tcbH) (tcb_cte_cases (irq_cnode_ptr && mask 9)) = (case Low_cte_cte Low_cnode_ptr irq_cnode_ptr of None \<Rightarrow> case High_cte_cte High_cnode_ptr irq_cnode_ptr of None \<Rightarrow> case Silc_cte_cte Silc_cnode_ptr irq_cnode_ptr of None \<Rightarrow> Some (CTE capability.NullCap (MDB 0 0 False False)) | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2)) \<and> (x \<noteq> irq_cnode_ptr \<longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x) \<longrightarrow> (\<exists>a. (\<exists>b. tcb_cte_cases (x && mask 9) = Some (a, b)) \<and> a idle_tcbH = CTE capability.NullCap (MDB 0 0 False False))) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x) \<longrightarrow> map_option (\<lambda>(getF, setF). getF idle_tcbH) (tcb_cte_cases (x && mask 9)) = (case Low_cte_cte Low_cnode_ptr x of None \<Rightarrow> case High_cte_cte High_cnode_ptr x of None \<Rightarrow> case Silc_cte_cte Silc_cnode_ptr x of None \<Rightarrow> case Low_tcb_cte x of None \<Rightarrow> case High_tcb_cte x of None \<Rightarrow> case idle_tcb_cte x of None \<Rightarrow> None | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2)))
 2. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 3. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>kh0H x = None; x && ~~ mask 9 = idle_tcb_ptr; x \<in> tcb_offs_range idle_tcb_ptr\<rbrakk> \<Longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x) \<longrightarrow> (\<exists>a. (\<exists>b. tcb_cte_cases (x && mask 9) = Some (a, b)) \<and> a idle_tcbH = CTE capability.NullCap (MDB 0 0 False False))) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x) \<longrightarrow> map_option (\<lambda>(getF, setF). getF idle_tcbH) (tcb_cte_cases (x && mask 9)) = (case Low_cte_cte Low_cnode_ptr x of None \<Rightarrow> case High_cte_cte High_cnode_ptr x of None \<Rightarrow> case Silc_cte_cte Silc_cnode_ptr x of None \<Rightarrow> case Low_tcb_cte x of None \<Rightarrow> case High_tcb_cte x of None \<Rightarrow> case idle_tcb_cte x of None \<Rightarrow> None | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2))
 2. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 3. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>kh0H x = None; x && ~~ mask 9 = idle_tcb_ptr; x \<in> tcb_offs_range idle_tcb_ptr\<rbrakk> \<Longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x) \<longrightarrow> (\<exists>a. (\<exists>b. tcb_cte_cases (x && mask 9) = Some (a, b)) \<and> a idle_tcbH = CTE capability.NullCap (MDB 0 0 False False))) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x) \<longrightarrow> map_option (\<lambda>(getF, setF). getF idle_tcbH) (tcb_cte_cases (x && mask 9)) = (case idle_tcb_cte x of None \<Rightarrow> None | Some x2 \<Rightarrow> Some x2))
 2. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 3. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>kh0H x = None; x && ~~ mask 9 = idle_tcb_ptr; x \<in> tcb_offs_range idle_tcb_ptr\<rbrakk> \<Longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x) \<longrightarrow> map_option (\<lambda>(getF, setF). getF idle_tcbH) (tcb_cte_cases (x && mask 9)) = (case idle_tcb_cte x of None \<Rightarrow> None | Some x2 \<Rightarrow> Some x2)
 2. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 3. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>kh0H x = None; x && ~~ mask 9 = idle_tcb_ptr; x \<in> tcb_offs_range idle_tcb_ptr; \<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x\<rbrakk> \<Longrightarrow> map_option (\<lambda>(getF, setF). getF idle_tcbH) (tcb_cte_cases (x && mask 9)) = (case idle_tcb_cte x of None \<Rightarrow> None | Some x2 \<Rightarrow> Some x2)
 2. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 3. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>kh0H x = None; x && ~~ mask 9 = idle_tcb_ptr; x \<in> tcb_offs_range idle_tcb_ptr; \<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x\<rbrakk> \<Longrightarrow> (idle_tcb_cte x = None \<longrightarrow> tcb_cte_cases (x && mask 9) = None) \<and> (\<forall>x2. idle_tcb_cte x = Some x2 \<longrightarrow> (\<exists>a. (\<exists>b. tcb_cte_cases (x && mask 9) = Some (a, b)) \<and> a idle_tcbH = x2))
 2. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 3. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (4 subgoals):
 1. \<And>x. \<lbrakk>kh0H x = None; x && ~~ mask 9 = idle_tcb_ptr; x \<in> tcb_offs_range idle_tcb_ptr; \<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x\<rbrakk> \<Longrightarrow> idle_tcb_cte x = None \<longrightarrow> tcb_cte_cases (x && mask 9) = None
 2. \<And>x. \<lbrakk>kh0H x = None; x && ~~ mask 9 = idle_tcb_ptr; x \<in> tcb_offs_range idle_tcb_ptr; \<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x\<rbrakk> \<Longrightarrow> \<forall>x2. idle_tcb_cte x = Some x2 \<longrightarrow> (\<exists>a. (\<exists>b. tcb_cte_cases (x && mask 9) = Some (a, b)) \<and> a idle_tcbH = x2)
 3. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 4. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>kh0H x = None; x && ~~ mask 9 = idle_tcb_ptr; x \<in> tcb_offs_range idle_tcb_ptr; \<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x\<rbrakk> \<Longrightarrow> \<forall>x2. idle_tcb_cte x = Some x2 \<longrightarrow> (\<exists>a. (\<exists>b. tcb_cte_cases (x && mask 9) = Some (a, b)) \<and> a idle_tcbH = x2)
 2. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 3. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (3 subgoals):
 1. \<And>x x2. \<lbrakk>kh0H x = None; x && ~~ mask 9 = idle_tcb_ptr; x \<in> tcb_offs_range idle_tcb_ptr; \<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x; idle_tcb_cte x = Some x2\<rbrakk> \<Longrightarrow> \<exists>a. (\<exists>b. tcb_cte_cases (x && mask 9) = Some (a, b)) \<and> a idle_tcbH = x2
 2. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 3. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (2 subgoals):
 1. \<And>x. kh0H x = None \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 2. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (2 subgoals):
 1. \<And>x. x \<notin> dom kh0H \<Longrightarrow> ((\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> ({(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 2. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (3 subgoals):
 1. \<And>x. x \<notin> dom kh0H \<Longrightarrow> (\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 2. \<And>x. x \<notin> dom kh0H \<Longrightarrow> {(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 3. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>x \<noteq> init_globals_frame; x \<noteq> idle_tcb_ptr; x \<noteq> High_tcb_ptr; x \<noteq> Low_tcb_ptr; x \<noteq> irq_cnode_ptr; x \<noteq> ntfn_ptr; x \<notin> irq_node_offs_range; x \<notin> cnode_offs_range Silc_cnode_ptr; x \<notin> cnode_offs_range High_cnode_ptr; x \<notin> cnode_offs_range Low_cnode_ptr; x \<notin> pd_offs_range init_global_pd; x \<notin> pd_offs_range High_pd_ptr; x \<notin> pd_offs_range Low_pd_ptr; x \<notin> pt_offs_range High_pt_ptr; x \<notin> pt_offs_range Low_pt_ptr\<rbrakk> \<Longrightarrow> ((\<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x) \<longrightarrow> (\<exists>tcb. kh0H (x && ~~ mask 9) = Some (KOTCB tcb))) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x) \<longrightarrow> (\<forall>tcb. kh0H (x && ~~ mask 9) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = (case Low_cte_cte Low_cnode_ptr x of None \<Rightarrow> case High_cte_cte High_cnode_ptr x of None \<Rightarrow> case Silc_cte_cte Silc_cnode_ptr x of None \<Rightarrow> case Low_tcb_cte x of None \<Rightarrow> case High_tcb_cte x of None \<Rightarrow> case idle_tcb_cte x of None \<Rightarrow> None | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2))
 2. \<And>x. x \<notin> dom kh0H \<Longrightarrow> {(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 3. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (2 subgoals):
 1. \<And>x. x \<notin> dom kh0H \<Longrightarrow> {(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 2. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>x \<notin> dom kh0H; {(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {}\<rbrakk> \<Longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 2. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>x \<notin> dom kh0H; {(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {}; x && ~~ mask 9 \<noteq> High_tcb_ptr\<rbrakk> \<Longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 2. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>x \<notin> dom kh0H; {(x && ~~ mask 9) + 1..0x1FF + (x && ~~ mask 9)} \<inter> dom kh0H \<noteq> {}; x && ~~ mask 9 \<noteq> High_tcb_ptr; x && ~~ mask 9 \<noteq> Low_tcb_ptr\<rbrakk> \<Longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 2. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>x \<notin> dom kh0H; x && ~~ mask 9 \<noteq> High_tcb_ptr; x && ~~ mask 9 \<noteq> Low_tcb_ptr; x && ~~ mask 9 \<noteq> idle_tcb_ptr\<rbrakk> \<Longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 2. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>x && ~~ mask 9 \<noteq> High_tcb_ptr; x && ~~ mask 9 \<noteq> Low_tcb_ptr; x && ~~ mask 9 \<noteq> idle_tcb_ptr; x \<noteq> init_globals_frame; x \<noteq> idle_tcb_ptr; x \<noteq> High_tcb_ptr; x \<noteq> Low_tcb_ptr; x \<noteq> irq_cnode_ptr; x \<noteq> ntfn_ptr; x \<notin> irq_node_offs_range; x \<notin> cnode_offs_range Silc_cnode_ptr; x \<notin> cnode_offs_range High_cnode_ptr; x \<notin> cnode_offs_range Low_cnode_ptr; x \<notin> pd_offs_range init_global_pd; x \<notin> pd_offs_range High_pd_ptr; x \<notin> pd_offs_range Low_pd_ptr; x \<notin> pt_offs_range High_pt_ptr; x \<notin> pt_offs_range Low_pt_ptr\<rbrakk> \<Longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 2. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>x && ~~ mask 9 \<noteq> High_tcb_ptr; x && ~~ mask 9 \<noteq> Low_tcb_ptr; x && ~~ mask 9 \<noteq> idle_tcb_ptr; x \<noteq> init_globals_frame; x \<noteq> idle_tcb_ptr; x \<noteq> High_tcb_ptr; x \<noteq> Low_tcb_ptr; x \<noteq> irq_cnode_ptr; x \<noteq> ntfn_ptr; x \<notin> irq_node_offs_range; x \<notin> cnode_offs_range Silc_cnode_ptr; x \<notin> cnode_offs_range High_cnode_ptr; x \<notin> cnode_offs_range Low_cnode_ptr; x \<notin> pd_offs_range init_global_pd; x \<notin> pd_offs_range High_pd_ptr; x \<notin> pd_offs_range Low_pd_ptr; x \<notin> pt_offs_range High_pt_ptr; x \<notin> pt_offs_range Low_pt_ptr\<rbrakk> \<Longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x) \<longrightarrow> None = (case Low_cte_cte Low_cnode_ptr x of None \<Rightarrow> case High_cte_cte High_cnode_ptr x of None \<Rightarrow> case Silc_cte_cte Silc_cnode_ptr x of None \<Rightarrow> case Low_tcb_cte x of None \<Rightarrow> case High_tcb_cte x of None \<Rightarrow> case idle_tcb_cte x of None \<Rightarrow> None | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2))
 2. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>x && ~~ mask 9 \<noteq> High_tcb_ptr; x && ~~ mask 9 \<noteq> Low_tcb_ptr; x && ~~ mask 9 \<noteq> idle_tcb_ptr; x \<noteq> init_globals_frame; x \<noteq> idle_tcb_ptr; x \<noteq> High_tcb_ptr; x \<noteq> Low_tcb_ptr; x \<noteq> irq_cnode_ptr; x \<noteq> ntfn_ptr; x \<notin> irq_node_offs_range; x \<notin> cnode_offs_range Silc_cnode_ptr; x \<notin> cnode_offs_range High_cnode_ptr; x \<notin> cnode_offs_range Low_cnode_ptr; x \<notin> pd_offs_range init_global_pd; x \<notin> pd_offs_range High_pd_ptr; x \<notin> pd_offs_range Low_pd_ptr; x \<notin> pt_offs_range High_pt_ptr; x \<notin> pt_offs_range Low_pt_ptr\<rbrakk> \<Longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x) \<longrightarrow> None = (case Low_tcb_cte x of None \<Rightarrow> case High_tcb_cte x of None \<Rightarrow> case idle_tcb_cte x of None \<Rightarrow> None | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2))
 2. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>x && ~~ mask 9 \<noteq> High_tcb_ptr; x && ~~ mask 9 \<noteq> Low_tcb_ptr; x && ~~ mask 9 \<noteq> idle_tcb_ptr; x \<noteq> init_globals_frame; x \<noteq> idle_tcb_ptr; x \<noteq> High_tcb_ptr; x \<noteq> Low_tcb_ptr; x \<noteq> irq_cnode_ptr; x \<noteq> ntfn_ptr; x \<notin> irq_node_offs_range; x \<notin> cnode_offs_range Silc_cnode_ptr; x \<notin> cnode_offs_range High_cnode_ptr; x \<notin> cnode_offs_range Low_cnode_ptr; x \<notin> pd_offs_range init_global_pd; x \<notin> pd_offs_range High_pd_ptr; x \<notin> pd_offs_range Low_pd_ptr; x \<notin> pt_offs_range High_pt_ptr; x \<notin> pt_offs_range Low_pt_ptr\<rbrakk> \<Longrightarrow> (\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x) \<and> ((\<forall>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<noteq> x) \<longrightarrow> None = (case None of None \<Rightarrow> case None of None \<Rightarrow> case None of None \<Rightarrow> None | Some x \<Rightarrow> Some x | Some x \<Rightarrow> Some x | Some x \<Rightarrow> Some x))
 2. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (1 subgoal):
 1. \<And>x a. kh0H x = Some a \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (1 subgoal):
 1. \<And>x a. \<lbrakk>kh0H x = Some a; x = init_globals_frame \<and> a = KOUserData \<or> x = idle_tcb_ptr \<and> a = KOTCB idle_tcbH \<or> x = High_tcb_ptr \<and> a = KOTCB High_tcbH \<or> x = Low_tcb_ptr \<and> a = KOTCB Low_tcbH \<or> x = ntfn_ptr \<and> a = KONotification ntfnH \<or> x = irq_cnode_ptr \<and> a = KOCTE irq_cte \<or> x \<in> irq_node_offs_range \<and> a = KOCTE (CTE capability.NullCap (MDB 0 0 False False)) \<or> x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> a = the (Low_cte Low_cnode_ptr x) \<or> x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> a = the (High_cte High_cnode_ptr x) \<or> x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> a = the (Silc_cte Silc_cnode_ptr x) \<or> x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> a = the (global_pdH' init_global_pd x) \<or> x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> a = the (High_pdH High_pd_ptr x) \<or> x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> a = the (Low_pdH Low_pd_ptr x) \<or> x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> a = the (High_ptH High_pt_ptr x) \<or> x \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr x \<noteq> None \<and> a = the (Low_ptH Low_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (15 subgoals):
 1. \<And>x a. \<lbrakk>kh0H x = Some a; x = init_globals_frame \<and> a = KOUserData\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 2. \<And>x a. \<lbrakk>kh0H x = Some a; x = idle_tcb_ptr \<and> a = KOTCB idle_tcbH\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 3. \<And>x a. \<lbrakk>kh0H x = Some a; x = High_tcb_ptr \<and> a = KOTCB High_tcbH\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 4. \<And>x a. \<lbrakk>kh0H x = Some a; x = Low_tcb_ptr \<and> a = KOTCB Low_tcbH\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 5. \<And>x a. \<lbrakk>kh0H x = Some a; x = ntfn_ptr \<and> a = KONotification ntfnH\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 6. \<And>x a. \<lbrakk>kh0H x = Some a; x = irq_cnode_ptr \<and> a = KOCTE irq_cte\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 7. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> irq_node_offs_range \<and> a = KOCTE (CTE capability.NullCap (MDB 0 0 False False))\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 8. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> a = the (Low_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 9. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> a = the (High_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 10. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> a = the (Silc_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x a. \<lbrakk>kh0H x = Some a; x = idle_tcb_ptr \<and> a = KOTCB idle_tcbH\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 2. \<And>x a. \<lbrakk>kh0H x = Some a; x = High_tcb_ptr \<and> a = KOTCB High_tcbH\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 3. \<And>x a. \<lbrakk>kh0H x = Some a; x = Low_tcb_ptr \<and> a = KOTCB Low_tcbH\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 4. \<And>x a. \<lbrakk>kh0H x = Some a; x = ntfn_ptr \<and> a = KONotification ntfnH\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 5. \<And>x a. \<lbrakk>kh0H x = Some a; x = irq_cnode_ptr \<and> a = KOCTE irq_cte\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 6. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> irq_node_offs_range \<and> a = KOCTE (CTE capability.NullCap (MDB 0 0 False False))\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 7. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> a = the (Low_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 8. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> a = the (High_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 9. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> a = the (Silc_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 10. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> a = the (global_pdH' init_global_pd x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
A total of 14 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x a. \<lbrakk>kh0H x = Some a; x = ntfn_ptr \<and> a = KONotification ntfnH\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 2. \<And>x a. \<lbrakk>kh0H x = Some a; x = irq_cnode_ptr \<and> a = KOCTE irq_cte\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 3. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> irq_node_offs_range \<and> a = KOCTE (CTE capability.NullCap (MDB 0 0 False False))\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 4. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> a = the (Low_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 5. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> a = the (High_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 6. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> a = the (Silc_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 7. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> a = the (global_pdH' init_global_pd x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 8. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> a = the (High_pdH High_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 9. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> a = the (Low_pdH Low_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 10. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> a = the (High_ptH High_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>x a. \<lbrakk>kh0H x = Some a; x = irq_cnode_ptr \<and> a = KOCTE irq_cte\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 2. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> irq_node_offs_range \<and> a = KOCTE (CTE capability.NullCap (MDB 0 0 False False))\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 3. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> a = the (Low_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 4. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> a = the (High_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 5. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> a = the (Silc_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 6. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> a = the (global_pdH' init_global_pd x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 7. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> a = the (High_pdH High_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 8. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> a = the (Low_pdH Low_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 9. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> a = the (High_ptH High_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 10. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr x \<noteq> None \<and> a = the (Low_ptH Low_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (9 subgoals):
 1. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> irq_node_offs_range \<and> a = KOCTE (CTE capability.NullCap (MDB 0 0 False False))\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 2. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> a = the (Low_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 3. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> a = the (High_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 4. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> a = the (Silc_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 5. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> a = the (global_pdH' init_global_pd x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 6. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> a = the (High_pdH High_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 7. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> a = the (Low_pdH Low_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 8. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> a = the (High_ptH High_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 9. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr x \<noteq> None \<and> a = the (Low_ptH Low_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (9 subgoals):
 1. \<And>x. \<lbrakk>kh0H x = Some (KOCTE (CTE capability.NullCap (MDB 0 0 False False))); x \<in> irq_node_offs_range\<rbrakk> \<Longrightarrow> (if is_aligned x (objBitsKO (KOCTE undefined)) \<and> {x + 1..x + 2 ^ objBitsKO (KOCTE undefined) - 1} \<inter> dom kh0H = {} then Some (CTE capability.NullCap (MDB 0 0 False False)) else if (\<exists>tcb. kh0H (x && ~~ mask (objBitsKO (KOTCB undefined))) = Some (KOTCB tcb)) \<and> {(x && ~~ mask (objBitsKO (KOTCB undefined))) + 1..(x && ~~ mask (objBitsKO (KOTCB undefined))) + 2 ^ objBitsKO (KOTCB undefined) - 1} \<inter> dom kh0H = {} then case kh0H (x && ~~ mask (objBitsKO (KOTCB undefined))) of Some (KOTCB tcb) \<Rightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x - (x && ~~ mask (objBitsKO (KOTCB undefined))))) else None) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 2. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> a = the (Low_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 3. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> a = the (High_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 4. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> a = the (Silc_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 5. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> a = the (global_pdH' init_global_pd x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 6. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> a = the (High_pdH High_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 7. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> a = the (Low_pdH Low_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 8. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> a = the (High_ptH High_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 9. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr x \<noteq> None \<and> a = the (Low_ptH Low_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (9 subgoals):
 1. \<And>x. \<lbrakk>kh0H x = Some (KOCTE (CTE capability.NullCap (MDB 0 0 False False))); x \<in> irq_node_offs_range; \<exists>irq. x = init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)\<rbrakk> \<Longrightarrow> (if is_aligned x (objBitsKO (KOCTE undefined)) \<and> {x + 1..x + 2 ^ objBitsKO (KOCTE undefined) - 1} \<inter> dom kh0H = {} then Some (CTE capability.NullCap (MDB 0 0 False False)) else if (\<exists>tcb. kh0H (x && ~~ mask (objBitsKO (KOTCB undefined))) = Some (KOTCB tcb)) \<and> {(x && ~~ mask (objBitsKO (KOTCB undefined))) + 1..(x && ~~ mask (objBitsKO (KOTCB undefined))) + 2 ^ objBitsKO (KOTCB undefined) - 1} \<inter> dom kh0H = {} then case kh0H (x && ~~ mask (objBitsKO (KOTCB undefined))) of Some (KOTCB tcb) \<Rightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x - (x && ~~ mask (objBitsKO (KOTCB undefined))))) else None) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 2. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> a = the (Low_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 3. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> a = the (High_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 4. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> a = the (Silc_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 5. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> a = the (global_pdH' init_global_pd x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 6. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> a = the (High_pdH High_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 7. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> a = the (Low_pdH Low_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 8. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> a = the (High_ptH High_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 9. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr x \<noteq> None \<and> a = the (Low_ptH Low_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (9 subgoals):
 1. \<And>x. \<lbrakk>kh0H x = Some (KOCTE (CTE capability.NullCap (MDB 0 0 False False))); x \<in> irq_node_offs_range; \<exists>irq. x = init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)\<rbrakk> \<Longrightarrow> (is_aligned x (objBitsKO (KOCTE undefined)) \<and> {x + 1..x + 2 ^ objBitsKO (KOCTE undefined) - 1} \<inter> dom kh0H = {} \<longrightarrow> Some (CTE capability.NullCap (MDB 0 0 False False)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x) \<and> (\<not> (is_aligned x (objBitsKO (KOCTE undefined)) \<and> {x + 1..x + 2 ^ objBitsKO (KOCTE undefined) - 1} \<inter> dom kh0H = {}) \<longrightarrow> (if (\<exists>tcb. kh0H (x && ~~ mask (objBitsKO (KOTCB undefined))) = Some (KOTCB tcb)) \<and> {(x && ~~ mask (objBitsKO (KOTCB undefined))) + 1..(x && ~~ mask (objBitsKO (KOTCB undefined))) + 2 ^ objBitsKO (KOTCB undefined) - 1} \<inter> dom kh0H = {} then case kh0H (x && ~~ mask (objBitsKO (KOTCB undefined))) of Some (KOTCB tcb) \<Rightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x - (x && ~~ mask (objBitsKO (KOTCB undefined))))) else None) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x)
 2. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> a = the (Low_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 3. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> a = the (High_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 4. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> a = the (Silc_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 5. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> a = the (global_pdH' init_global_pd x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 6. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> a = the (High_pdH High_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 7. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> a = the (Low_pdH Low_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 8. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> a = the (High_ptH High_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 9. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr x \<noteq> None \<and> a = the (Low_ptH Low_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (10 subgoals):
 1. \<And>x. \<lbrakk>kh0H x = Some (KOCTE (CTE capability.NullCap (MDB 0 0 False False))); x \<in> irq_node_offs_range; \<exists>irq. x = init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)\<rbrakk> \<Longrightarrow> is_aligned x (objBitsKO (KOCTE undefined)) \<and> {x + 1..x + 2 ^ objBitsKO (KOCTE undefined) - 1} \<inter> dom kh0H = {} \<longrightarrow> Some (CTE capability.NullCap (MDB 0 0 False False)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 2. \<And>x. \<lbrakk>kh0H x = Some (KOCTE (CTE capability.NullCap (MDB 0 0 False False))); x \<in> irq_node_offs_range; \<exists>irq. x = init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)\<rbrakk> \<Longrightarrow> \<not> (is_aligned x (objBitsKO (KOCTE undefined)) \<and> {x + 1..x + 2 ^ objBitsKO (KOCTE undefined) - 1} \<inter> dom kh0H = {}) \<longrightarrow> (if (\<exists>tcb. kh0H (x && ~~ mask (objBitsKO (KOTCB undefined))) = Some (KOTCB tcb)) \<and> {(x && ~~ mask (objBitsKO (KOTCB undefined))) + 1..(x && ~~ mask (objBitsKO (KOTCB undefined))) + 2 ^ objBitsKO (KOTCB undefined) - 1} \<inter> dom kh0H = {} then case kh0H (x && ~~ mask (objBitsKO (KOTCB undefined))) of Some (KOTCB tcb) \<Rightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x - (x && ~~ mask (objBitsKO (KOTCB undefined))))) else None) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 3. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> a = the (Low_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 4. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> a = the (High_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 5. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> a = the (Silc_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 6. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> a = the (global_pdH' init_global_pd x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 7. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> a = the (High_pdH High_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 8. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> a = the (Low_pdH Low_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 9. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> a = the (High_ptH High_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 10. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr x \<noteq> None \<and> a = the (Low_ptH Low_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (10 subgoals):
 1. \<And>x. \<lbrakk>kh0H x = Some (KOCTE (CTE capability.NullCap (MDB 0 0 False False))); x \<in> irq_node_offs_range; \<exists>irq. x = init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits); is_aligned x (objBitsKO (KOCTE undefined)) \<and> {x + 1..x + 2 ^ objBitsKO (KOCTE undefined) - 1} \<inter> dom kh0H = {}\<rbrakk> \<Longrightarrow> Some (CTE capability.NullCap (MDB 0 0 False False)) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 2. \<And>x. \<lbrakk>kh0H x = Some (KOCTE (CTE capability.NullCap (MDB 0 0 False False))); x \<in> irq_node_offs_range; \<exists>irq. x = init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)\<rbrakk> \<Longrightarrow> \<not> (is_aligned x (objBitsKO (KOCTE undefined)) \<and> {x + 1..x + 2 ^ objBitsKO (KOCTE undefined) - 1} \<inter> dom kh0H = {}) \<longrightarrow> (if (\<exists>tcb. kh0H (x && ~~ mask (objBitsKO (KOTCB undefined))) = Some (KOTCB tcb)) \<and> {(x && ~~ mask (objBitsKO (KOTCB undefined))) + 1..(x && ~~ mask (objBitsKO (KOTCB undefined))) + 2 ^ objBitsKO (KOTCB undefined) - 1} \<inter> dom kh0H = {} then case kh0H (x && ~~ mask (objBitsKO (KOTCB undefined))) of Some (KOTCB tcb) \<Rightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x - (x && ~~ mask (objBitsKO (KOTCB undefined))))) else None) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 3. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> a = the (Low_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 4. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> a = the (High_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 5. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> a = the (Silc_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 6. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> a = the (global_pdH' init_global_pd x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 7. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> a = the (High_pdH High_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 8. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> a = the (Low_pdH Low_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 9. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> a = the (High_ptH High_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 10. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr x \<noteq> None \<and> a = the (Low_ptH Low_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (10 subgoals):
 1. \<And>irq. \<lbrakk>init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<in> irq_node_offs_range; is_aligned (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)) (objBitsKO (KOCTE undefined)); {init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) + 1..init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) + 2 ^ objBitsKO (KOCTE undefined) - 1} \<inter> dom kh0H = {}; \<forall>irqa. UCAST(10 \<rightarrow> 32) irqa << cte_level_bits \<noteq> UCAST(10 \<rightarrow> 32) irq << cte_level_bits\<rbrakk> \<Longrightarrow> Some (CTE capability.NullCap (MDB 0 0 False False)) = (case Low_cte_cte Low_cnode_ptr (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)) of None \<Rightarrow> case High_cte_cte High_cnode_ptr (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)) of None \<Rightarrow> case Silc_cte_cte Silc_cnode_ptr (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)) of None \<Rightarrow> case Low_tcb_cte (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)) of None \<Rightarrow> case High_tcb_cte (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)) of None \<Rightarrow> case idle_tcb_cte (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)) of None \<Rightarrow> None | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2 | Some x2 \<Rightarrow> Some x2)
 2. \<And>x. \<lbrakk>kh0H x = Some (KOCTE (CTE capability.NullCap (MDB 0 0 False False))); x \<in> irq_node_offs_range; \<exists>irq. x = init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)\<rbrakk> \<Longrightarrow> \<not> (is_aligned x (objBitsKO (KOCTE undefined)) \<and> {x + 1..x + 2 ^ objBitsKO (KOCTE undefined) - 1} \<inter> dom kh0H = {}) \<longrightarrow> (if (\<exists>tcb. kh0H (x && ~~ mask (objBitsKO (KOTCB undefined))) = Some (KOTCB tcb)) \<and> {(x && ~~ mask (objBitsKO (KOTCB undefined))) + 1..(x && ~~ mask (objBitsKO (KOTCB undefined))) + 2 ^ objBitsKO (KOTCB undefined) - 1} \<inter> dom kh0H = {} then case kh0H (x && ~~ mask (objBitsKO (KOTCB undefined))) of Some (KOTCB tcb) \<Rightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x - (x && ~~ mask (objBitsKO (KOTCB undefined))))) else None) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 3. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> a = the (Low_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 4. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> a = the (High_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 5. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> a = the (Silc_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 6. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> a = the (global_pdH' init_global_pd x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 7. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> a = the (High_pdH High_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 8. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> a = the (Low_pdH Low_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 9. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> a = the (High_ptH High_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 10. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr x \<noteq> None \<and> a = the (Low_ptH Low_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (9 subgoals):
 1. \<And>x. \<lbrakk>kh0H x = Some (KOCTE (CTE capability.NullCap (MDB 0 0 False False))); x \<in> irq_node_offs_range; \<exists>irq. x = init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)\<rbrakk> \<Longrightarrow> \<not> (is_aligned x (objBitsKO (KOCTE undefined)) \<and> {x + 1..x + 2 ^ objBitsKO (KOCTE undefined) - 1} \<inter> dom kh0H = {}) \<longrightarrow> (if (\<exists>tcb. kh0H (x && ~~ mask (objBitsKO (KOTCB undefined))) = Some (KOTCB tcb)) \<and> {(x && ~~ mask (objBitsKO (KOTCB undefined))) + 1..(x && ~~ mask (objBitsKO (KOTCB undefined))) + 2 ^ objBitsKO (KOTCB undefined) - 1} \<inter> dom kh0H = {} then case kh0H (x && ~~ mask (objBitsKO (KOTCB undefined))) of Some (KOTCB tcb) \<Rightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x - (x && ~~ mask (objBitsKO (KOTCB undefined))))) else None) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 2. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> a = the (Low_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 3. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> a = the (High_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 4. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> a = the (Silc_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 5. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> a = the (global_pdH' init_global_pd x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 6. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> a = the (High_pdH High_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 7. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> a = the (Low_pdH Low_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 8. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> a = the (High_ptH High_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 9. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr x \<noteq> None \<and> a = the (Low_ptH Low_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (9 subgoals):
 1. \<And>x. \<lbrakk>kh0H x = Some (KOCTE (CTE capability.NullCap (MDB 0 0 False False))); x \<in> irq_node_offs_range; \<exists>irq. x = init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits); \<not> (is_aligned x (objBitsKO (KOCTE undefined)) \<and> {x + 1..x + 2 ^ objBitsKO (KOCTE undefined) - 1} \<inter> dom kh0H = {})\<rbrakk> \<Longrightarrow> (if (\<exists>tcb. kh0H (x && ~~ mask (objBitsKO (KOTCB undefined))) = Some (KOTCB tcb)) \<and> {(x && ~~ mask (objBitsKO (KOTCB undefined))) + 1..(x && ~~ mask (objBitsKO (KOTCB undefined))) + 2 ^ objBitsKO (KOTCB undefined) - 1} \<inter> dom kh0H = {} then case kh0H (x && ~~ mask (objBitsKO (KOTCB undefined))) of Some (KOTCB tcb) \<Rightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (x - (x && ~~ mask (objBitsKO (KOTCB undefined))))) else None) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) x
 2. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> a = the (Low_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 3. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> a = the (High_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 4. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> a = the (Silc_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 5. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> a = the (global_pdH' init_global_pd x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 6. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> a = the (High_pdH High_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 7. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> a = the (Low_pdH Low_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 8. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> a = the (High_ptH High_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 9. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr x \<noteq> None \<and> a = the (Low_ptH Low_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (9 subgoals):
 1. \<And>irq. \<lbrakk>init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<in> irq_node_offs_range; is_aligned (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)) (objBitsKO (KOCTE undefined)) \<longrightarrow> {init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) + 1..init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) + 2 ^ objBitsKO (KOCTE undefined) - 1} \<inter> dom kh0H \<noteq> {}\<rbrakk> \<Longrightarrow> ((\<exists>tcb. kh0H (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) = Some (KOTCB tcb)) \<and> {(init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) + 1..(init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) + 2 ^ objBitsKO (KOTCB undefined) - 1} \<inter> dom kh0H = {} \<longrightarrow> (case kh0H (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) of Some (KOTCB tcb) \<Rightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) - (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined)))))) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits))) \<and> ((\<forall>tcb. kh0H (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits))) \<and> ({(init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) + 1..(init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) + 2 ^ objBitsKO (KOTCB undefined) - 1} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)))
 2. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> a = the (Low_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 3. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> a = the (High_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 4. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> a = the (Silc_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 5. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> a = the (global_pdH' init_global_pd x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 6. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> a = the (High_pdH High_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 7. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> a = the (Low_pdH Low_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 8. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> a = the (High_ptH High_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 9. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr x \<noteq> None \<and> a = the (Low_ptH Low_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (10 subgoals):
 1. \<And>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<in> irq_node_offs_range \<Longrightarrow> is_aligned (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)) (objBitsKO (KOCTE undefined))
 2. \<And>irq. \<lbrakk>init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<in> irq_node_offs_range; {init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) + 1..init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) + 2 ^ objBitsKO (KOCTE undefined) - 1} \<inter> dom kh0H \<noteq> {}\<rbrakk> \<Longrightarrow> ((\<exists>tcb. kh0H (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) = Some (KOTCB tcb)) \<and> {(init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) + 1..(init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) + 2 ^ objBitsKO (KOTCB undefined) - 1} \<inter> dom kh0H = {} \<longrightarrow> (case kh0H (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) of Some (KOTCB tcb) \<Rightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) - (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined)))))) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits))) \<and> ((\<forall>tcb. kh0H (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits))) \<and> ({(init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) + 1..(init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) + 2 ^ objBitsKO (KOTCB undefined) - 1} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)))
 3. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> a = the (Low_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 4. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> a = the (High_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 5. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> a = the (Silc_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 6. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> a = the (global_pdH' init_global_pd x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 7. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> a = the (High_pdH High_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 8. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> a = the (Low_pdH Low_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 9. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> a = the (High_ptH High_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 10. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr x \<noteq> None \<and> a = the (Low_ptH Low_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (11 subgoals):
 1. \<And>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<in> irq_node_offs_range \<Longrightarrow> is_aligned init_irq_node_ptr (objBitsKO (KOCTE undefined))
 2. \<And>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<in> irq_node_offs_range \<Longrightarrow> is_aligned (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) (objBitsKO (KOCTE undefined))
 3. \<And>irq. \<lbrakk>init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<in> irq_node_offs_range; {init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) + 1..init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) + 2 ^ objBitsKO (KOCTE undefined) - 1} \<inter> dom kh0H \<noteq> {}\<rbrakk> \<Longrightarrow> ((\<exists>tcb. kh0H (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) = Some (KOTCB tcb)) \<and> {(init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) + 1..(init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) + 2 ^ objBitsKO (KOTCB undefined) - 1} \<inter> dom kh0H = {} \<longrightarrow> (case kh0H (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) of Some (KOTCB tcb) \<Rightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) - (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined)))))) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits))) \<and> ((\<forall>tcb. kh0H (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits))) \<and> ({(init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) + 1..(init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) + 2 ^ objBitsKO (KOTCB undefined) - 1} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)))
 4. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> a = the (Low_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 5. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> a = the (High_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 6. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> a = the (Silc_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 7. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> a = the (global_pdH' init_global_pd x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 8. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> a = the (High_pdH High_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 9. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> a = the (Low_pdH Low_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 10. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> a = the (High_ptH High_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<in> irq_node_offs_range \<Longrightarrow> is_aligned (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) (objBitsKO (KOCTE undefined))
 2. \<And>irq. \<lbrakk>init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<in> irq_node_offs_range; {init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) + 1..init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) + 2 ^ objBitsKO (KOCTE undefined) - 1} \<inter> dom kh0H \<noteq> {}\<rbrakk> \<Longrightarrow> ((\<exists>tcb. kh0H (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) = Some (KOTCB tcb)) \<and> {(init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) + 1..(init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) + 2 ^ objBitsKO (KOTCB undefined) - 1} \<inter> dom kh0H = {} \<longrightarrow> (case kh0H (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) of Some (KOTCB tcb) \<Rightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) - (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined)))))) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits))) \<and> ((\<forall>tcb. kh0H (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits))) \<and> ({(init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) + 1..(init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) + 2 ^ objBitsKO (KOTCB undefined) - 1} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)))
 3. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> a = the (Low_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 4. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> a = the (High_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 5. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> a = the (Silc_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 6. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> a = the (global_pdH' init_global_pd x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 7. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> a = the (High_pdH High_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 8. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> a = the (Low_pdH Low_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 9. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> a = the (High_ptH High_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 10. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr x \<noteq> None \<and> a = the (Low_ptH Low_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (10 subgoals):
 1. \<And>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<in> irq_node_offs_range \<Longrightarrow> is_aligned (UCAST(10 \<rightarrow> 32) irq) (objBitsKO (KOCTE undefined) - cte_level_bits)
 2. \<And>irq. \<lbrakk>init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<in> irq_node_offs_range; {init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) + 1..init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) + 2 ^ objBitsKO (KOCTE undefined) - 1} \<inter> dom kh0H \<noteq> {}\<rbrakk> \<Longrightarrow> ((\<exists>tcb. kh0H (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) = Some (KOTCB tcb)) \<and> {(init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) + 1..(init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) + 2 ^ objBitsKO (KOTCB undefined) - 1} \<inter> dom kh0H = {} \<longrightarrow> (case kh0H (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) of Some (KOTCB tcb) \<Rightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) - (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined)))))) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits))) \<and> ((\<forall>tcb. kh0H (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits))) \<and> ({(init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) + 1..(init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) + 2 ^ objBitsKO (KOTCB undefined) - 1} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)))
 3. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> a = the (Low_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 4. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> a = the (High_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 5. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> a = the (Silc_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 6. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> a = the (global_pdH' init_global_pd x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 7. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> a = the (High_pdH High_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 8. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> a = the (Low_pdH Low_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 9. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> a = the (High_ptH High_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 10. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr x \<noteq> None \<and> a = the (Low_ptH Low_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (9 subgoals):
 1. \<And>irq. \<lbrakk>init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<in> irq_node_offs_range; {init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) + 1..init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) + 2 ^ objBitsKO (KOCTE undefined) - 1} \<inter> dom kh0H \<noteq> {}\<rbrakk> \<Longrightarrow> ((\<exists>tcb. kh0H (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) = Some (KOTCB tcb)) \<and> {(init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) + 1..(init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) + 2 ^ objBitsKO (KOTCB undefined) - 1} \<inter> dom kh0H = {} \<longrightarrow> (case kh0H (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) of Some (KOTCB tcb) \<Rightarrow> map_option (\<lambda>(getF, setF). getF tcb) (tcb_cte_cases (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) - (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined)))))) = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits))) \<and> ((\<forall>tcb. kh0H (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) \<noteq> Some (KOTCB tcb)) \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits))) \<and> ({(init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) + 1..(init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) && ~~ mask (objBitsKO (KOTCB undefined))) + 2 ^ objBitsKO (KOTCB undefined) - 1} \<inter> dom kh0H \<noteq> {} \<longrightarrow> None = option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) (option_update_range (Low_cte_cte Low_cnode_ptr) (option_update_range (High_cte_cte High_cnode_ptr) (option_update_range (Silc_cte_cte Silc_cnode_ptr) (option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] (option_update_range Low_tcb_cte (option_update_range High_tcb_cte (option_update_range idle_tcb_cte (\<lambda>x. None)))))))) (init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits)))
 2. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> a = the (Low_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 3. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> a = the (High_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 4. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> a = the (Silc_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 5. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> a = the (global_pdH' init_global_pd x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 6. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> a = the (High_pdH High_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 7. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> a = the (Low_pdH Low_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 8. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> a = the (High_ptH High_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 9. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr x \<noteq> None \<and> a = the (Low_ptH Low_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (9 subgoals):
 1. \<And>irq. \<lbrakk>init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) \<in> irq_node_offs_range; {init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) + 1..init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) + 2 ^ objBitsKO (KOCTE undefined) - 1} \<inter> dom kh0H \<noteq> {}\<rbrakk> \<Longrightarrow> False
 2. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> a = the (Low_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 3. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> a = the (High_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 4. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> a = the (Silc_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 5. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> a = the (global_pdH' init_global_pd x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 6. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> a = the (High_pdH High_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 7. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> a = the (Low_pdH Low_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 8. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> a = the (High_ptH High_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 9. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr x \<noteq> None \<and> a = the (Low_ptH Low_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (9 subgoals):
 1. \<And>irq. \<lbrakk>0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0005000 \<and> 0xE0005000 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0001000 \<and> 0xE0001000 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0000400 \<and> 0xE0000400 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0000200 \<and> 0xE0000200 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE001C000 \<and> 0xE001C000 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0000010 \<and> 0xE0000010 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> {0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4)..0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4)} \<inter> ({x. 0xE0008000 \<le> x \<and> x < 0xE000C000} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0018000 \<le> x \<and> x \<le> 0xE001BFFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0014000 \<le> x \<and> x \<le> 0xE0017FFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0010000 \<le> x \<and> x \<le> 0xE0013FFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0060000 \<le> x \<and> x \<le> 0xE0063FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0024000 \<le> x \<and> x \<le> 0xE0027FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0020000 \<le> x \<and> x \<le> 0xE0023FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0000C00 \<le> x \<and> x \<le> 0xE0000FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0000800 \<le> x \<and> x \<le> 0xE0000BFF} \<inter> {x. is_aligned x 2}) \<noteq> {}; 0xE0008000 \<le> 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4); 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4) < 0xE000C000; is_aligned (0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4)) 4\<rbrakk> \<Longrightarrow> False
 2. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> a = the (Low_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 3. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> a = the (High_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 4. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> a = the (Silc_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 5. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> a = the (global_pdH' init_global_pd x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 6. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> a = the (High_pdH High_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 7. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> a = the (Low_pdH Low_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 8. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> a = the (High_ptH High_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 9. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr x \<noteq> None \<and> a = the (Low_ptH Low_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (10 subgoals):
 1. \<And>irq. \<lbrakk>0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0005000 \<and> 0xE0005000 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0001000 \<and> 0xE0001000 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0000400 \<and> 0xE0000400 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0000200 \<and> 0xE0000200 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE001C000 \<and> 0xE001C000 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0000010 \<and> 0xE0000010 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> {0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4)..0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4)} \<inter> ({x. 0xE0008000 \<le> x \<and> x < 0xE000C000} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0018000 \<le> x \<and> x \<le> 0xE001BFFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0014000 \<le> x \<and> x \<le> 0xE0017FFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0010000 \<le> x \<and> x \<le> 0xE0013FFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0060000 \<le> x \<and> x \<le> 0xE0063FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0024000 \<le> x \<and> x \<le> 0xE0027FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0020000 \<le> x \<and> x \<le> 0xE0023FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0000C00 \<le> x \<and> x \<le> 0xE0000FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0000800 \<le> x \<and> x \<le> 0xE0000BFF} \<inter> {x. is_aligned x 2}) \<noteq> {}; 0xE0008000 \<le> 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4); 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4) < 0xE000C000; is_aligned (0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4)) 4\<rbrakk> \<Longrightarrow> LENGTH(10) < LENGTH(32)
 2. \<And>irq. \<lbrakk>0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0005000 \<and> 0xE0005000 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0001000 \<and> 0xE0001000 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0000400 \<and> 0xE0000400 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0000200 \<and> 0xE0000200 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE001C000 \<and> 0xE001C000 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0000010 \<and> 0xE0000010 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> {0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4)..0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4)} \<inter> ({x. 0xE0008000 \<le> x \<and> x < 0xE000C000} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0018000 \<le> x \<and> x \<le> 0xE001BFFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0014000 \<le> x \<and> x \<le> 0xE0017FFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0010000 \<le> x \<and> x \<le> 0xE0013FFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0060000 \<le> x \<and> x \<le> 0xE0063FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0024000 \<le> x \<and> x \<le> 0xE0027FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0020000 \<le> x \<and> x \<le> 0xE0023FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0000C00 \<le> x \<and> x \<le> 0xE0000FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0000800 \<le> x \<and> x \<le> 0xE0000BFF} \<inter> {x. is_aligned x 2}) \<noteq> {}; 0xE0008000 \<le> 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4); 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4) < 0xE000C000; is_aligned (0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4)) 4; UCAST(10 \<rightarrow> 32) irq < 2 ^ LENGTH(10)\<rbrakk> \<Longrightarrow> False
 3. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> a = the (Low_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 4. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> a = the (High_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 5. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> a = the (Silc_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 6. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> a = the (global_pdH' init_global_pd x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 7. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> a = the (High_pdH High_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 8. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> a = the (Low_pdH Low_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 9. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> a = the (High_ptH High_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 10. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr x \<noteq> None \<and> a = the (Low_ptH Low_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (9 subgoals):
 1. \<And>irq. \<lbrakk>0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0005000 \<and> 0xE0005000 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0001000 \<and> 0xE0001000 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0000400 \<and> 0xE0000400 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0000200 \<and> 0xE0000200 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE001C000 \<and> 0xE001C000 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0000010 \<and> 0xE0000010 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> {0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4)..0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4)} \<inter> ({x. 0xE0008000 \<le> x \<and> x < 0xE000C000} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0018000 \<le> x \<and> x \<le> 0xE001BFFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0014000 \<le> x \<and> x \<le> 0xE0017FFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0010000 \<le> x \<and> x \<le> 0xE0013FFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0060000 \<le> x \<and> x \<le> 0xE0063FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0024000 \<le> x \<and> x \<le> 0xE0027FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0020000 \<le> x \<and> x \<le> 0xE0023FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0000C00 \<le> x \<and> x \<le> 0xE0000FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0000800 \<le> x \<and> x \<le> 0xE0000BFF} \<inter> {x. is_aligned x 2}) \<noteq> {}; 0xE0008000 \<le> 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4); 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4) < 0xE000C000; is_aligned (0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4)) 4; UCAST(10 \<rightarrow> 32) irq < 2 ^ LENGTH(10)\<rbrakk> \<Longrightarrow> False
 2. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> a = the (Low_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 3. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> a = the (High_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 4. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> a = the (Silc_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 5. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> a = the (global_pdH' init_global_pd x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 6. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> a = the (High_pdH High_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 7. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> a = the (Low_pdH Low_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 8. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> a = the (High_ptH High_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 9. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr x \<noteq> None \<and> a = the (Low_ptH Low_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (10 subgoals):
 1. \<And>irq. \<lbrakk>0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0005000 \<and> 0xE0005000 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0001000 \<and> 0xE0001000 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0000400 \<and> 0xE0000400 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0000200 \<and> 0xE0000200 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE001C000 \<and> 0xE001C000 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0000010 \<and> 0xE0000010 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> {0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4)..0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4)} \<inter> ({x. 0xE0008000 \<le> x \<and> x < 0xE000C000} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0018000 \<le> x \<and> x \<le> 0xE001BFFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0014000 \<le> x \<and> x \<le> 0xE0017FFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0010000 \<le> x \<and> x \<le> 0xE0013FFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0060000 \<le> x \<and> x \<le> 0xE0063FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0024000 \<le> x \<and> x \<le> 0xE0027FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0020000 \<le> x \<and> x \<le> 0xE0023FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0000C00 \<le> x \<and> x \<le> 0xE0000FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0000800 \<le> x \<and> x \<le> 0xE0000BFF} \<inter> {x. is_aligned x 2}) \<noteq> {}; 0xE0008000 \<le> 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4); 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4) < 0xE000C000; is_aligned (0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4)) 4\<rbrakk> \<Longrightarrow> LENGTH(10) + 4 < LENGTH(32)
 2. \<And>irq. \<lbrakk>0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0005000 \<and> 0xE0005000 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0001000 \<and> 0xE0001000 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0000400 \<and> 0xE0000400 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0000200 \<and> 0xE0000200 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE001C000 \<and> 0xE001C000 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0000010 \<and> 0xE0000010 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> {0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4)..0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4)} \<inter> ({x. 0xE0008000 \<le> x \<and> x < 0xE000C000} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0018000 \<le> x \<and> x \<le> 0xE001BFFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0014000 \<le> x \<and> x \<le> 0xE0017FFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0010000 \<le> x \<and> x \<le> 0xE0013FFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0060000 \<le> x \<and> x \<le> 0xE0063FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0024000 \<le> x \<and> x \<le> 0xE0027FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0020000 \<le> x \<and> x \<le> 0xE0023FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0000C00 \<le> x \<and> x \<le> 0xE0000FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0000800 \<le> x \<and> x \<le> 0xE0000BFF} \<inter> {x. is_aligned x 2}) \<noteq> {}; 0xE0008000 \<le> 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4); 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4) < 0xE000C000; is_aligned (0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4)) 4; UCAST(10 \<rightarrow> 32) irq << 4 < 2 ^ (LENGTH(10) + 4)\<rbrakk> \<Longrightarrow> False
 3. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> a = the (Low_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 4. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> a = the (High_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 5. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> a = the (Silc_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 6. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> a = the (global_pdH' init_global_pd x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 7. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> a = the (High_pdH High_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 8. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> a = the (Low_pdH Low_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 9. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> a = the (High_ptH High_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 10. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr x \<noteq> None \<and> a = the (Low_ptH Low_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (9 subgoals):
 1. \<And>irq. \<lbrakk>0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0005000 \<and> 0xE0005000 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0001000 \<and> 0xE0001000 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0000400 \<and> 0xE0000400 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0000200 \<and> 0xE0000200 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE001C000 \<and> 0xE001C000 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0000010 \<and> 0xE0000010 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> {0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4)..0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4)} \<inter> ({x. 0xE0008000 \<le> x \<and> x < 0xE000C000} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0018000 \<le> x \<and> x \<le> 0xE001BFFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0014000 \<le> x \<and> x \<le> 0xE0017FFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0010000 \<le> x \<and> x \<le> 0xE0013FFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0060000 \<le> x \<and> x \<le> 0xE0063FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0024000 \<le> x \<and> x \<le> 0xE0027FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0020000 \<le> x \<and> x \<le> 0xE0023FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0000C00 \<le> x \<and> x \<le> 0xE0000FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0000800 \<le> x \<and> x \<le> 0xE0000BFF} \<inter> {x. is_aligned x 2}) \<noteq> {}; 0xE0008000 \<le> 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4); 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4) < 0xE000C000; is_aligned (0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4)) 4; UCAST(10 \<rightarrow> 32) irq << 4 < 2 ^ (LENGTH(10) + 4)\<rbrakk> \<Longrightarrow> False
 2. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> a = the (Low_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 3. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> a = the (High_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 4. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> a = the (Silc_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 5. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> a = the (global_pdH' init_global_pd x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 6. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> a = the (High_pdH High_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 7. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> a = the (Low_pdH Low_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 8. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> a = the (High_ptH High_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 9. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr x \<noteq> None \<and> a = the (Low_ptH Low_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (9 subgoals):
 1. \<And>irq. \<lbrakk>0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0005000 \<and> 0xE0005000 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0001000 \<and> 0xE0001000 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0000400 \<and> 0xE0000400 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0000200 \<and> 0xE0000200 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE001C000 \<and> 0xE001C000 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0000010 \<and> 0xE0000010 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> {0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4)..0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4)} \<inter> ({x. 0xE0008000 \<le> x \<and> x < 0xE000C000} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0018000 \<le> x \<and> x \<le> 0xE001BFFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0014000 \<le> x \<and> x \<le> 0xE0017FFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0010000 \<le> x \<and> x \<le> 0xE0013FFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0060000 \<le> x \<and> x \<le> 0xE0063FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0024000 \<le> x \<and> x \<le> 0xE0027FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0020000 \<le> x \<and> x \<le> 0xE0023FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0000C00 \<le> x \<and> x \<le> 0xE0000FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0000800 \<le> x \<and> x \<le> 0xE0000BFF} \<inter> {x. is_aligned x 2}) \<noteq> {}; 0xE0008000 \<le> 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4); 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4) < 0xE000C000; is_aligned (0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4)) 4; UCAST(10 \<rightarrow> 32) irq << 4 < 0x4000\<rbrakk> \<Longrightarrow> False
 2. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> a = the (Low_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 3. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> a = the (High_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 4. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> a = the (Silc_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 5. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> a = the (global_pdH' init_global_pd x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 6. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> a = the (High_pdH High_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 7. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> a = the (Low_pdH Low_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 8. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> a = the (High_ptH High_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 9. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr x \<noteq> None \<and> a = the (Low_ptH Low_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (9 subgoals):
 1. \<And>irq. \<lbrakk>0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0005000 \<and> 0xE0005000 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0001000 \<and> 0xE0001000 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0000400 \<and> 0xE0000400 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0000200 \<and> 0xE0000200 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE001C000 \<and> 0xE001C000 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0000010 \<and> 0xE0000010 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4) \<or> {0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4)..0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4)} \<inter> ({x. 0xE0008000 \<le> x \<and> x < 0xE000C000} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0018000 \<le> x \<and> x \<le> 0xE001BFFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0014000 \<le> x \<and> x \<le> 0xE0017FFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0010000 \<le> x \<and> x \<le> 0xE0013FFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0060000 \<le> x \<and> x \<le> 0xE0063FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0024000 \<le> x \<and> x \<le> 0xE0027FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0020000 \<le> x \<and> x \<le> 0xE0023FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0000C00 \<le> x \<and> x \<le> 0xE0000FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0000800 \<le> x \<and> x \<le> 0xE0000BFF} \<inter> {x. is_aligned x 2}) \<noteq> {}; 0xE0008000 \<le> 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4); 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4) < 0xE000C000; is_aligned (0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4)) 4; UCAST(10 \<rightarrow> 32) irq << 4 \<le> 0x3FFF\<rbrakk> \<Longrightarrow> False
 2. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> a = the (Low_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 3. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> a = the (High_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 4. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> a = the (Silc_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 5. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> a = the (global_pdH' init_global_pd x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 6. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> a = the (High_pdH High_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 7. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> a = the (Low_pdH Low_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 8. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> a = the (High_ptH High_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 9. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr x \<noteq> None \<and> a = the (Low_ptH Low_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (15 subgoals):
 1. \<And>irq. \<lbrakk>0xE0008000 \<le> 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4); 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4) < 0xE000C000; is_aligned (0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4)) 4; UCAST(10 \<rightarrow> 32) irq << 4 \<le> 0x3FFF; 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0005000 \<and> 0xE0005000 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4)\<rbrakk> \<Longrightarrow> False
 2. \<And>irq. \<lbrakk>0xE0008000 \<le> 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4); 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4) < 0xE000C000; is_aligned (0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4)) 4; UCAST(10 \<rightarrow> 32) irq << 4 \<le> 0x3FFF; 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0001000 \<and> 0xE0001000 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4)\<rbrakk> \<Longrightarrow> False
 3. \<And>irq. \<lbrakk>0xE0008000 \<le> 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4); 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4) < 0xE000C000; is_aligned (0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4)) 4; UCAST(10 \<rightarrow> 32) irq << 4 \<le> 0x3FFF; 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0000400 \<and> 0xE0000400 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4)\<rbrakk> \<Longrightarrow> False
 4. \<And>irq. \<lbrakk>0xE0008000 \<le> 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4); 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4) < 0xE000C000; is_aligned (0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4)) 4; UCAST(10 \<rightarrow> 32) irq << 4 \<le> 0x3FFF; 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0000200 \<and> 0xE0000200 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4)\<rbrakk> \<Longrightarrow> False
 5. \<And>irq. \<lbrakk>0xE0008000 \<le> 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4); 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4) < 0xE000C000; is_aligned (0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4)) 4; UCAST(10 \<rightarrow> 32) irq << 4 \<le> 0x3FFF; 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE001C000 \<and> 0xE001C000 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4)\<rbrakk> \<Longrightarrow> False
 6. \<And>irq. \<lbrakk>0xE0008000 \<le> 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4); 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4) < 0xE000C000; is_aligned (0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4)) 4; UCAST(10 \<rightarrow> 32) irq << 4 \<le> 0x3FFF; 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> 0xE0000010 \<and> 0xE0000010 \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4)\<rbrakk> \<Longrightarrow> False
 7. \<And>irq. \<lbrakk>0xE0008000 \<le> 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4); 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4) < 0xE000C000; is_aligned (0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4)) 4; UCAST(10 \<rightarrow> 32) irq << 4 \<le> 0x3FFF; {0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4)..0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4)} \<inter> ({x. 0xE0008000 \<le> x \<and> x < 0xE000C000} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0018000 \<le> x \<and> x \<le> 0xE001BFFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0014000 \<le> x \<and> x \<le> 0xE0017FFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0010000 \<le> x \<and> x \<le> 0xE0013FFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0060000 \<le> x \<and> x \<le> 0xE0063FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0024000 \<le> x \<and> x \<le> 0xE0027FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0020000 \<le> x \<and> x \<le> 0xE0023FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0000C00 \<le> x \<and> x \<le> 0xE0000FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0000800 \<le> x \<and> x \<le> 0xE0000BFF} \<inter> {x. is_aligned x 2}) \<noteq> {}\<rbrakk> \<Longrightarrow> False
 8. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> a = the (Low_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 9. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> a = the (High_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 10. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> a = the (Silc_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
A total of 15 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>irq. \<lbrakk>0xE0008000 \<le> 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4); 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4) < 0xE000C000; is_aligned (0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4)) 4; UCAST(10 \<rightarrow> 32) irq << 4 \<le> 0x3FFF; {0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4)..0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4)} \<inter> ({x. 0xE0008000 \<le> x \<and> x < 0xE000C000} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0018000 \<le> x \<and> x \<le> 0xE001BFFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0014000 \<le> x \<and> x \<le> 0xE0017FFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0010000 \<le> x \<and> x \<le> 0xE0013FFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0060000 \<le> x \<and> x \<le> 0xE0063FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0024000 \<le> x \<and> x \<le> 0xE0027FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0020000 \<le> x \<and> x \<le> 0xE0023FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0000C00 \<le> x \<and> x \<le> 0xE0000FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0000800 \<le> x \<and> x \<le> 0xE0000BFF} \<inter> {x. is_aligned x 2}) \<noteq> {}\<rbrakk> \<Longrightarrow> False
 2. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> a = the (Low_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 3. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> a = the (High_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 4. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> a = the (Silc_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 5. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> a = the (global_pdH' init_global_pd x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 6. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> a = the (High_pdH High_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 7. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> a = the (Low_pdH Low_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 8. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> a = the (High_ptH High_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 9. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr x \<noteq> None \<and> a = the (Low_ptH Low_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (9 subgoals):
 1. \<And>irq. \<lbrakk>0xE0008000 \<le> 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4); 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4) < 0xE000C000; is_aligned (0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4)) 4; UCAST(10 \<rightarrow> 32) irq << 4 \<le> 0x3FFF; \<exists>x. x \<in> {0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4)..0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4)} \<and> x \<in> {x. 0xE0008000 \<le> x \<and> x < 0xE000C000} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0018000 \<le> x \<and> x \<le> 0xE001BFFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0014000 \<le> x \<and> x \<le> 0xE0017FFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0010000 \<le> x \<and> x \<le> 0xE0013FFF} \<inter> {x. is_aligned x 4} \<union> {x. 0xE0060000 \<le> x \<and> x \<le> 0xE0063FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0024000 \<le> x \<and> x \<le> 0xE0027FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0020000 \<le> x \<and> x \<le> 0xE0023FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0000C00 \<le> x \<and> x \<le> 0xE0000FFF} \<inter> {x. is_aligned x 2} \<union> {x. 0xE0000800 \<le> x \<and> x \<le> 0xE0000BFF} \<inter> {x. is_aligned x 2}\<rbrakk> \<Longrightarrow> False
 2. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> a = the (Low_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 3. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> a = the (High_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 4. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> a = the (Silc_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 5. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> a = the (global_pdH' init_global_pd x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 6. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> a = the (High_pdH High_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 7. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> a = the (Low_pdH Low_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 8. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> a = the (High_ptH High_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 9. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr x \<noteq> None \<and> a = the (Low_ptH Low_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (9 subgoals):
 1. \<And>irq x. \<lbrakk>0xE0008000 \<le> 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4); 0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4) < 0xE000C000; is_aligned (0xE0008000 + (UCAST(10 \<rightarrow> 32) irq << 4)) 4; UCAST(10 \<rightarrow> 32) irq << 4 \<le> 0x3FFF; 0xE0008001 + (UCAST(10 \<rightarrow> 32) irq << 4) \<le> x; x \<le> 0xE000800F + (UCAST(10 \<rightarrow> 32) irq << 4); 0xE0008000 \<le> x \<and> x < 0xE000C000 \<and> is_aligned x 4 \<or> 0xE0018000 \<le> x \<and> x \<le> 0xE001BFFF \<and> is_aligned x 4 \<or> 0xE0014000 \<le> x \<and> x \<le> 0xE0017FFF \<and> is_aligned x 4 \<or> 0xE0010000 \<le> x \<and> x \<le> 0xE0013FFF \<and> is_aligned x 4 \<or> 0xE0060000 \<le> x \<and> x \<le> 0xE0063FFF \<and> is_aligned x 2 \<or> 0xE0024000 \<le> x \<and> x \<le> 0xE0027FFF \<and> is_aligned x 2 \<or> 0xE0020000 \<le> x \<and> x \<le> 0xE0023FFF \<and> is_aligned x 2 \<or> 0xE0000C00 \<le> x \<and> x \<le> 0xE0000FFF \<and> is_aligned x 2 \<or> 0xE0000800 \<le> x \<and> x \<le> 0xE0000BFF \<and> is_aligned x 2\<rbrakk> \<Longrightarrow> False
 2. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> a = the (Low_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 3. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> a = the (High_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 4. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> a = the (Silc_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 5. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> a = the (global_pdH' init_global_pd x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 6. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> a = the (High_pdH High_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 7. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> a = the (Low_pdH Low_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 8. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> a = the (High_ptH High_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 9. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr x \<noteq> None \<and> a = the (Low_ptH Low_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (8 subgoals):
 1. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> a = the (Low_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 2. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> a = the (High_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 3. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> a = the (Silc_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 4. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> a = the (global_pdH' init_global_pd x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 5. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> a = the (High_pdH High_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 6. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> a = the (Low_pdH Low_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 7. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> a = the (High_ptH High_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 8. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr x \<noteq> None \<and> a = the (Low_ptH Low_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (5 subgoals):
 1. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> a = the (global_pdH' init_global_pd x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 2. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> a = the (High_pdH High_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 3. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> a = the (Low_pdH Low_pd_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 4. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> a = the (High_ptH High_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 5. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr x \<noteq> None \<and> a = the (Low_ptH Low_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x proof (prove)
goal (2 subgoals):
 1. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> a = the (High_ptH High_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x
 2. \<And>x a. \<lbrakk>kh0H x = Some a; x \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr x \<noteq> None \<and> a = the (Low_ptH Low_pt_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H x = (option_update_range (\<lambda>x. if \<exists>irq. init_irq_node_ptr + (UCAST(10 \<rightarrow> 32) irq << cte_level_bits) = x then Some (CTE capability.NullCap (MDB 0 0 False False)) else None) \<circ> option_update_range (Low_cte_cte Low_cnode_ptr) \<circ> option_update_range (High_cte_cte High_cnode_ptr) \<circ> option_update_range (Silc_cte_cte Silc_cnode_ptr) \<circ> option_update_range [irq_cnode_ptr \<mapsto> CTE capability.NullCap (MDB 0 0 False False)] \<circ> option_update_range Low_tcb_cte \<circ> option_update_range High_tcb_cte \<circ> option_update_range idle_tcb_cte) (\<lambda>x. None) x