theory PageTableDuplicates

lemma createObject_valid_duplicates'[wp]:
  "\<lbrace>(\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct'
   and pspace_no_overlap' ptr (getObjectSize ty us)
   and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits)
   and K (is_aligned ptr (getObjectSize ty us))
   and K (ty = APIObjectType apiobject_type.CapTableObject \<longrightarrow> us < 28)\<rbrace>
  RetypeDecls_H.createObject ty ptr us d
  \<lbrace>\<lambda>xa s. vs_valid_duplicates' (ksPSpace s)\<rbrace>" apply (rule hoare_gen_asm) apply (simp add:createObject_def) apply (rule hoare_pre) apply (wpc | wp| simp add: ARM_H.createObject_def split del: if_split)+ apply (simp add: placeNewObject_def placeNewDataObject_def
                          placeNewObject'_def split_def split del: if_split
           | wp unless_wp[where P="d"] unless_wp[where Q=\<top>]
           | wpc | simp add: alignError_def split del: if_split)+ apply (rule copyGlobalMappings_valid_duplicates') apply ((wp unless_wp[where P="d"] unless_wp[where Q=\<top>] | wpc
            | simp add: alignError_def placeNewObject_def
                        placeNewObject'_def split_def split del: if_split)+)[2] apply (intro conjI impI) apply clarsimp+ apply (erule(2) valid_duplicates'_update) apply (clarsimp simp: vs_entry_align_def)+ apply (erule(2) valid_duplicates'_update) apply (clarsimp simp: vs_entry_align_def)+ apply ((clarsimp simp: new_cap_addrs_fold'[where n = "0x10",simplified]
            | (erule valid_duplicates'_insert_ko[where us = 4,simplified]
              , (simp add: toAPIType_def vs_entry_align_def
                           APIType_capBits_def objBits_simps pageBits_def)+)[1]
            | rule none_in_new_cap_addrs[where us = 4,simplified,THEN bspec,rotated -1]
            | simp add: objBits_simps pageBits_def word_bits_conv)+)[1] apply ((clarsimp simp: new_cap_addrs_fold'[where n = "0x10",simplified]
           | (erule valid_duplicates'_insert_ko[where us = 4,simplified]
             , (simp add: toAPIType_def vs_entry_align_def
                          APIType_capBits_def objBits_simps pageBits_def)+)[1]
           | rule none_in_new_cap_addrs[where us = 4,simplified,THEN bspec,rotated -1]
           | simp add: objBits_simps pageBits_def word_bits_conv)+)[1] apply ((clarsimp simp: new_cap_addrs_fold'[where n = "0x100",simplified]
          | (erule valid_duplicates'_insert_ko[where us = 8,simplified]
            , (simp add: toAPIType_def vs_entry_align_def
                         APIType_capBits_def objBits_simps pageBits_def)+)[1]
          | rule none_in_new_cap_addrs[where us = 8,simplified,THEN bspec,rotated -1]
          | simp add: objBits_simps pageBits_def word_bits_conv)+)[1] apply (clarsimp simp: new_cap_addrs_fold'[where n = "0x100",simplified]) apply (erule valid_duplicates'_insert_ko[where us = 8,simplified]) apply (simp add: toAPIType_def vs_entry_align_def
                           APIType_capBits_def objBits_simps pageBits_def)+ apply (rule none_in_new_cap_addrs[where us =8,simplified]
        ,(simp add: objBits_simps pageBits_def word_bits_conv)+)[1] apply (clarsimp simp: new_cap_addrs_fold'[where n = "0x1000",simplified]) apply (erule valid_duplicates'_insert_ko[where us = 12,simplified]) apply (simp add: toAPIType_def vs_entry_align_def
                          APIType_capBits_def objBits_simps pageBits_def)+ apply (rule none_in_new_cap_addrs[where us =12,simplified]
       ,(simp add: objBits_simps pageBits_def word_bits_conv)+)[1] apply (clarsimp simp: new_cap_addrs_fold'[where n = "0x1000",simplified]) apply (erule valid_duplicates'_insert_ko[where us = 12,simplified]) apply (simp add: ARM_H.toAPIType_def vs_entry_align_def
                        APIType_capBits_def objBits_simps pageBits_def)+ apply (rule none_in_new_cap_addrs[where us =12,simplified]
      ,(simp add: objBits_simps pageBits_def word_bits_conv)+)[1] apply (clarsimp simp: objBits_simps ptBits_def archObjSize_def pageBits_def) apply (cut_tac ptr=ptr in new_cap_addrs_fold'[where n = "0x100" and ko = "(KOArch (KOPTE makeObject))"
      ,simplified objBits_simps]) apply simp apply (clarsimp simp: archObjSize_def) apply (erule valid_duplicates'_insert_ko[where us = 8,simplified]) apply (simp add: toAPIType_def archObjSize_def vs_entry_align_def
                       APIType_capBits_def objBits_simps pageBits_def
                       pdeBits_def pteBits_def
                split: ARM_H.pte.splits)+ apply (rule none_in_new_cap_addrs[where us =8,simplified]
      ,(simp add: objBits_simps pageBits_def word_bits_conv archObjSize_def pteBits_def)+)[1] apply clarsimp apply (cut_tac ptr=ptr in new_cap_addrs_fold'[where n = "0x1000" and ko = "(KOArch (KOPDE makeObject))"
     ,simplified objBits_simps]) apply simp apply (clarsimp simp: objBits_simps archObjSize_def pdBits_def pageBits_def) apply (frule(2) retype_aligned_distinct'[where n = 4096 and ko = "KOArch (KOPDE makeObject)"]) apply (simp add:objBits_simps archObjSize_def) apply (rule range_cover_rel[OF range_cover_full]) apply simp apply (simp add:APIType_capBits_def word_bits_def pdeBits_def)+ apply (frule(2) retype_aligned_distinct'(2)[where n = 4096 and ko = "KOArch (KOPDE makeObject)"]) apply (simp add:objBits_simps archObjSize_def) apply (rule range_cover_rel[OF range_cover_full]) apply simp apply (simp add:APIType_capBits_def word_bits_def pdeBits_def)+ apply (subgoal_tac "vs_valid_duplicates'
                (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject)))
                  (map (\<lambda>n. ptr + (n << 2)) [0.e.2 ^ (pdBits - 2) - 1]) (ksPSpace s))") apply (simp add:APIType_capBits_def pdBits_def pageBits_def pdeBits_def
     data_map_insert_def[abs_def]) apply (clarsimp simp: archObjSize_def pdBits_def pageBits_def pdeBits_def) apply (rule valid_duplicates'_insert_ko[where us = 12,simplified]) apply (simp add: ARM_H.toAPIType_def archObjSize_def vs_entry_align_def
                       APIType_capBits_def objBits_simps pageBits_def pdeBits_def
                split: ARM_H.pde.splits)+ apply (rule none_in_new_cap_addrs[where us =12,simplified]
     ,(simp add: objBits_simps pageBits_def word_bits_conv archObjSize_def pdeBits_def)+)[1] apply (intro conjI impI allI) apply simp apply clarsimp apply (drule(2) valid_duplicates'_update) prefer 3 apply fastforce apply (simp add: vs_entry_align_def) apply simp apply clarsimp apply (drule(2) valid_duplicates'_update) prefer 3 apply (fastforce simp: vs_entry_align_def)+ apply clarsimp apply (drule(2) valid_duplicates'_update) prefer 3 apply (fastforce simp: vs_entry_align_def)+ apply (clarsimp simp:ARM_H.toAPIType_def word_bits_def
                 split:ARM_H.object_type.splits) apply (cut_tac ptr = ptr in new_cap_addrs_fold'[where n = "2^us"
   and ko = "(KOCTE makeObject)",simplified]) apply (rule word_1_le_power) apply (clarsimp simp: word_bits_def) apply (drule_tac ptr = ptr and ko = "KOCTE makeObject" in
    valid_duplicates'_insert_ko[where us = us,simplified]) apply (simp add: APIType_capBits_def is_aligned_mask ARM_H.toAPIType_def
                split: ARM_H.object_type.splits) apply (simp add: vs_entry_align_def) apply (simp add: objBits_simps') apply (rule none_in_new_cap_addrs
     ,(simp add: objBits_simps' pageBits_def APIType_capBits_def
                 ARM_H.toAPIType_def
                 word_bits_conv archObjSize_def is_aligned_mask
          split: ARM_H.object_type.splits)+)[1] apply (clarsimp simp: word_bits_def) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>(\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (getObjectSize ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr (getObjectSize ty us)) and K (ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28)\<rbrace> global.createObject ty ptr us d \<lbrace>\<lambda>xa s. vs_valid_duplicates' (ksPSpace s)\<rbrace> proof (prove)
goal (1 subgoal):
 1. ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28 \<Longrightarrow> \<lbrace>(\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (getObjectSize ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr (getObjectSize ty us))\<rbrace> global.createObject ty ptr us d \<lbrace>\<lambda>xa s. vs_valid_duplicates' (ksPSpace s)\<rbrace> proof (prove)
goal (1 subgoal):
 1. ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28 \<Longrightarrow> \<lbrace>(\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))\<rbrace> case toAPIType ty of None \<Rightarrow> do archCap <- Arch.createObject ty ptr us d;
return (capability.ArchObjectCap archCap)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap d (PPtr $ fromPPtr ptr) us 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject ptr makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr ptr);
return $ capability.ThreadCap (PPtr $ fromPPtr ptr)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject ptr makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr ptr) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr ptr) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr ptr) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr ptr) makeObject us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr ptr then Just us else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr ptr) us 0 0
od \<lbrace>\<lambda>xa s. vs_valid_duplicates' (ksPSpace s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28 \<Longrightarrow> \<lbrace>?Q7\<rbrace> case toAPIType ty of None \<Rightarrow> do archCap <- Arch.createObject ty ptr us d;
return (capability.ArchObjectCap archCap)
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap d (PPtr $ fromPPtr ptr) us 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject ptr makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr ptr);
return $ capability.ThreadCap (PPtr $ fromPPtr ptr)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject ptr makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr ptr) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr ptr) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr ptr) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr ptr) makeObject us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr ptr then Just us else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr ptr) us 0 0
od \<lbrace>\<lambda>xa s. vs_valid_duplicates' (ksPSpace s)\<rbrace>
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> ?Q7 s proof (prove)
goal (8 subgoals):
 1. \<lbrakk>toAPIType SmallPageObject = None; ty = SmallPageObject\<rbrakk> \<Longrightarrow> \<lbrace>?R39\<rbrace> placeNewDataObject ptr 0 d \<lbrace>\<lambda>x s. vs_valid_duplicates' (ksPSpace s)\<rbrace>
 2. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; toAPIType ty = None; ty = LargePageObject\<rbrakk> \<Longrightarrow> \<lbrace>?R38\<rbrace> do placeNewDataObject ptr 4 d;
modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = fromPPtr ptr then Just ARMLargePage else gsUserPages ks y\<rparr>);
return $ arch_capability.PageCap d (id ptr) VMReadWrite ARMLargePage None
od \<lbrace>\<lambda>archCap a. vs_valid_duplicates' (ksPSpace a)\<rbrace>
 3. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; toAPIType ty = None; ty = SectionObject\<rbrakk> \<Longrightarrow> \<lbrace>?R37\<rbrace> do placeNewDataObject ptr 8 d;
modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = fromPPtr ptr then Just ARMSection else gsUserPages ks y\<rparr>);
return $ arch_capability.PageCap d (id ptr) VMReadWrite ARMSection None
od \<lbrace>\<lambda>archCap a. vs_valid_duplicates' (ksPSpace a)\<rbrace>
 4. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; toAPIType ty = None; ty = SuperSectionObject\<rbrakk> \<Longrightarrow> \<lbrace>?R36\<rbrace> do placeNewDataObject ptr 12 d;
modify (\<lambda>ks. ks\<lparr>gsUserPages := \<lambda>y. if y = fromPPtr ptr then Just ARMSuperSection else gsUserPages ks y\<rparr>);
return $ arch_capability.PageCap d (id ptr) VMReadWrite ARMSuperSection None
od \<lbrace>\<lambda>archCap a. vs_valid_duplicates' (ksPSpace a)\<rbrace>
 5. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; toAPIType ty = None; ty = PageTableObject\<rbrakk> \<Longrightarrow> \<lbrace>?R35\<rbrace> do ptSize <- return (ptBits - objBits makeObject);
placeNewObject ptr makeObject ptSize;
return $ arch_capability.PageTableCap (id ptr) Nothing
od \<lbrace>\<lambda>archCap a. vs_valid_duplicates' (ksPSpace a)\<rbrace>
 6. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; toAPIType ty = None; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?R34\<rbrace> do pdSize <- return (pdBits - objBits makeObject);
regionSize <- return (1 `~shiftL~` pdBits);
placeNewObject ptr makeObject pdSize;
copyGlobalMappings (id ptr);
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr ptr) (VPtr $ fromPPtr ptr + regionSize - 1) (addrFromPPtr ptr);
return $ arch_capability.PageDirectoryCap (id ptr) Nothing
od \<lbrace>\<lambda>archCap a. vs_valid_duplicates' (ksPSpace a)\<rbrace>
 7. \<And>x2. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; toAPIType ty = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R19 x2\<rbrace> case x2 of ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap d (PPtr $ fromPPtr ptr) us 0 | ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject ptr makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr ptr);
return $ capability.ThreadCap (PPtr $ fromPPtr ptr)
od | ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject ptr makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr ptr) 0 True True True True
od | ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr ptr) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr ptr) 0 True True
od | ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr ptr) makeObject us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr ptr then Just us else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr ptr) us 0 0
od \<lbrace>\<lambda>xa s. vs_valid_duplicates' (ksPSpace s)\<rbrace>
 8. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> (toAPIType ty = None \<longrightarrow> (\<forall>x. ty = APIObjectType x \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (ty = SmallPageObject \<longrightarrow> ?R39 s) \<and> (ty = LargePageObject \<longrightarrow> ?R38 s) \<and> (ty = SectionObject \<longrightarrow> ?R37 s) \<and> (ty = SuperSectionObject \<longrightarrow> ?R36 s) \<and> (ty = PageTableObject \<longrightarrow> ?R35 s) \<and> (ty = PageDirectoryObject \<longrightarrow> ?R34 s)) \<and> (\<forall>x. toAPIType ty = Some x \<longrightarrow> ?R19 x s) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?B270 ()\<rbrace> copyGlobalMappings ptr \<lbrace>\<lambda>ya s. vs_valid_duplicates' (ksPSpace s)\<rbrace>
 2. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?R34\<rbrace> do y <- unless (ptr && mask (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) = 0) (alignError (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) ps) of None \<Rightarrow> return () | Some a \<Rightarrow> assert (fst a < ptr);
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) ps))
od \<lbrace>?B270\<rbrace>
 3. \<And>x2. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; toAPIType ty = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R19 x2\<rbrace> case x2 of ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap d (PPtr $ fromPPtr ptr) us 0 | ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject ptr makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr ptr);
return $ capability.ThreadCap (PPtr $ fromPPtr ptr)
od | ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject ptr makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr ptr) 0 True True True True
od | ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr ptr) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr ptr) 0 True True
od | ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr ptr) makeObject us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr ptr then Just us else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr ptr) us 0 0
od \<lbrace>\<lambda>xa s. vs_valid_duplicates' (ksPSpace s)\<rbrace>
 4. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> (toAPIType ty = None \<longrightarrow> (\<forall>x. ty = APIObjectType x \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (ty = SmallPageObject \<longrightarrow> (d \<longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice) = 0 then \<lambda>a. vs_valid_duplicates' (\<lambda>b. if b = ptr then Some KOUserDataDevice else ksPSpace a b) else (\<lambda>_. True)) s) \<and> (\<not> d \<longrightarrow> (if ptr && mask (objBitsKO KOUserData) = 0 then \<lambda>a. vs_valid_duplicates' (\<lambda>b. if b = ptr then Some KOUserData else ksPSpace a b) else (\<lambda>_. True)) s)) \<and> (ty = LargePageObject \<longrightarrow> (d \<longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 4) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xF]) (ksPSpace a)) else (\<lambda>_. True)) s) \<and> (\<not> d \<longrightarrow> (if ptr && mask (objBitsKO KOUserData + 4) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xF]) (ksPSpace a)) else (\<lambda>_. True)) s)) \<and> (ty = SectionObject \<longrightarrow> (d \<longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 8) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xFF]) (ksPSpace a)) else (\<lambda>_. True)) s) \<and> (\<not> d \<longrightarrow> (if ptr && mask (objBitsKO KOUserData + 8) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xFF]) (ksPSpace a)) else (\<lambda>_. True)) s)) \<and> (ty = SuperSectionObject \<longrightarrow> (d \<longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s) \<and> (\<not> d \<longrightarrow> (if ptr && mask (objBitsKO KOUserData + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s)) \<and> (ty = PageTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject)) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPTE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPTE makeObject)))) [0 .e. 2 ^ (ptBits - objBits makeObject) - 1]) (ksPSpace a)) else (\<lambda>_. True)) s) \<and> (ty = PageDirectoryObject \<longrightarrow> ?R34 s)) \<and> (\<forall>x. toAPIType ty = Some x \<longrightarrow> ?R19 x s) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> \<lbrace>?R34\<rbrace> do y <- unless (ptr && mask (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) = 0) (alignError (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)));
ps <- gets ksPSpace;
y <- case fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) ps) of None \<Rightarrow> return () | Some a \<Rightarrow> assert (fst a < ptr);
modify (ksPSpace_update (\<lambda>_. foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) ps))
od \<lbrace>\<lambda>a. (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)\<rbrace>
 2. \<And>x2. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; toAPIType ty = Some x2\<rbrakk> \<Longrightarrow> \<lbrace>?R19 x2\<rbrace> case x2 of ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap d (PPtr $ fromPPtr ptr) us 0 | ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject ptr makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr ptr);
return $ capability.ThreadCap (PPtr $ fromPPtr ptr)
od | ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject ptr makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr ptr) 0 True True True True
od | ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr ptr) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr ptr) 0 True True
od | ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr ptr) makeObject us;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr ptr then Just us else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr ptr) us 0 0
od \<lbrace>\<lambda>xa s. vs_valid_duplicates' (ksPSpace s)\<rbrace>
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> (toAPIType ty = None \<longrightarrow> (\<forall>x. ty = APIObjectType x \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (ty = SmallPageObject \<longrightarrow> (d \<longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice) = 0 then \<lambda>a. vs_valid_duplicates' (\<lambda>b. if b = ptr then Some KOUserDataDevice else ksPSpace a b) else (\<lambda>_. True)) s) \<and> (\<not> d \<longrightarrow> (if ptr && mask (objBitsKO KOUserData) = 0 then \<lambda>a. vs_valid_duplicates' (\<lambda>b. if b = ptr then Some KOUserData else ksPSpace a b) else (\<lambda>_. True)) s)) \<and> (ty = LargePageObject \<longrightarrow> (d \<longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 4) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xF]) (ksPSpace a)) else (\<lambda>_. True)) s) \<and> (\<not> d \<longrightarrow> (if ptr && mask (objBitsKO KOUserData + 4) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xF]) (ksPSpace a)) else (\<lambda>_. True)) s)) \<and> (ty = SectionObject \<longrightarrow> (d \<longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 8) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xFF]) (ksPSpace a)) else (\<lambda>_. True)) s) \<and> (\<not> d \<longrightarrow> (if ptr && mask (objBitsKO KOUserData + 8) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xFF]) (ksPSpace a)) else (\<lambda>_. True)) s)) \<and> (ty = SuperSectionObject \<longrightarrow> (d \<longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s) \<and> (\<not> d \<longrightarrow> (if ptr && mask (objBitsKO KOUserData + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s)) \<and> (ty = PageTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject)) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPTE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPTE makeObject)))) [0 .e. 2 ^ (ptBits - objBits makeObject) - 1]) (ksPSpace a)) else (\<lambda>_. True)) s) \<and> (ty = PageDirectoryObject \<longrightarrow> ?R34 s)) \<and> (\<forall>x. toAPIType ty = Some x \<longrightarrow> ?R19 x s) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> (toAPIType ty = None \<longrightarrow> (\<forall>x. ty = APIObjectType x \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (ty = SmallPageObject \<longrightarrow> (d \<longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice) = 0 then \<lambda>a. vs_valid_duplicates' (\<lambda>b. if b = ptr then Some KOUserDataDevice else ksPSpace a b) else (\<lambda>_. True)) s) \<and> (\<not> d \<longrightarrow> (if ptr && mask (objBitsKO KOUserData) = 0 then \<lambda>a. vs_valid_duplicates' (\<lambda>b. if b = ptr then Some KOUserData else ksPSpace a b) else (\<lambda>_. True)) s)) \<and> (ty = LargePageObject \<longrightarrow> (d \<longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 4) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xF]) (ksPSpace a)) else (\<lambda>_. True)) s) \<and> (\<not> d \<longrightarrow> (if ptr && mask (objBitsKO KOUserData + 4) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xF]) (ksPSpace a)) else (\<lambda>_. True)) s)) \<and> (ty = SectionObject \<longrightarrow> (d \<longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 8) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xFF]) (ksPSpace a)) else (\<lambda>_. True)) s) \<and> (\<not> d \<longrightarrow> (if ptr && mask (objBitsKO KOUserData + 8) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xFF]) (ksPSpace a)) else (\<lambda>_. True)) s)) \<and> (ty = SuperSectionObject \<longrightarrow> (d \<longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s) \<and> (\<not> d \<longrightarrow> (if ptr && mask (objBitsKO KOUserData + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s)) \<and> (ty = PageTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject)) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPTE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPTE makeObject)))) [0 .e. 2 ^ (ptBits - objBits makeObject) - 1]) (ksPSpace a)) else (\<lambda>_. True)) s) \<and> (ty = PageDirectoryObject \<longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = None \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) else (\<lambda>_. True)) s)) \<and> (\<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s)) proof (prove)
goal (12 subgoals):
 1. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None\<rbrakk> \<Longrightarrow> \<forall>x. ty = APIObjectType x \<longrightarrow> vs_valid_duplicates' (ksPSpace s)
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SmallPageObject; d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice) = 0 then \<lambda>a. vs_valid_duplicates' (\<lambda>b. if b = ptr then Some KOUserDataDevice else ksPSpace a b) else (\<lambda>_. True)) s
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SmallPageObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData) = 0 then \<lambda>a. vs_valid_duplicates' (\<lambda>b. if b = ptr then Some KOUserData else ksPSpace a b) else (\<lambda>_. True)) s
 4. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = LargePageObject; d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 4) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xF]) (ksPSpace a)) else (\<lambda>_. True)) s
 5. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = LargePageObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData + 4) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xF]) (ksPSpace a)) else (\<lambda>_. True)) s
 6. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SectionObject; d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 8) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 7. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SectionObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData + 8) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 8. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SuperSectionObject; d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 9. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SuperSectionObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 10. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject)) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPTE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPTE makeObject)))) [0 .e. 2 ^ (ptBits - objBits makeObject) - 1]) (ksPSpace a)) else (\<lambda>_. True)) s
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s. \<lbrakk>toAPIType SmallPageObject = None; ty = SmallPageObject; d; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits SmallPageObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits SmallPageObject us); ptr && mask (objBitsKO KOUserDataDevice) = 0\<rbrakk> \<Longrightarrow> vs_valid_duplicates' (\<lambda>a. if a = ptr then Some KOUserDataDevice else ksPSpace s a)
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SmallPageObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData) = 0 then \<lambda>a. vs_valid_duplicates' (\<lambda>b. if b = ptr then Some KOUserData else ksPSpace a b) else (\<lambda>_. True)) s
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = LargePageObject; d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 4) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xF]) (ksPSpace a)) else (\<lambda>_. True)) s
 4. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = LargePageObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData + 4) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xF]) (ksPSpace a)) else (\<lambda>_. True)) s
 5. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SectionObject; d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 8) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 6. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SectionObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData + 8) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 7. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SuperSectionObject; d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 8. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SuperSectionObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 9. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject)) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPTE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPTE makeObject)))) [0 .e. 2 ^ (ptBits - objBits makeObject) - 1]) (ksPSpace a)) else (\<lambda>_. True)) s
 10. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = None \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) else (\<lambda>_. True)) s
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s. \<lbrakk>toAPIType SmallPageObject = None; ty = SmallPageObject; d; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits SmallPageObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; ptr && mask (objBitsKO KOUserDataDevice) = 0\<rbrakk> \<Longrightarrow> vs_entry_align KOUserDataDevice = 0
 2. \<And>s. \<lbrakk>toAPIType SmallPageObject = None; ty = SmallPageObject; d; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits SmallPageObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; ptr && mask (objBitsKO KOUserDataDevice) = 0\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr (APIType_capBits SmallPageObject us) s
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SmallPageObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData) = 0 then \<lambda>a. vs_valid_duplicates' (\<lambda>b. if b = ptr then Some KOUserData else ksPSpace a b) else (\<lambda>_. True)) s
 4. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = LargePageObject; d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 4) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xF]) (ksPSpace a)) else (\<lambda>_. True)) s
 5. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = LargePageObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData + 4) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xF]) (ksPSpace a)) else (\<lambda>_. True)) s
 6. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SectionObject; d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 8) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 7. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SectionObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData + 8) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 8. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SuperSectionObject; d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 9. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SuperSectionObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 10. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject)) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPTE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPTE makeObject)))) [0 .e. 2 ^ (ptBits - objBits makeObject) - 1]) (ksPSpace a)) else (\<lambda>_. True)) s
A total of 12 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s. \<lbrakk>toAPIType SmallPageObject = None; ty = SmallPageObject; \<not> d; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits SmallPageObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits SmallPageObject us); ptr && mask (objBitsKO KOUserData) = 0\<rbrakk> \<Longrightarrow> vs_valid_duplicates' (\<lambda>a. if a = ptr then Some KOUserData else ksPSpace s a)
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = LargePageObject; d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 4) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xF]) (ksPSpace a)) else (\<lambda>_. True)) s
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = LargePageObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData + 4) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xF]) (ksPSpace a)) else (\<lambda>_. True)) s
 4. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SectionObject; d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 8) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 5. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SectionObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData + 8) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 6. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SuperSectionObject; d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 7. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SuperSectionObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 8. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject)) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPTE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPTE makeObject)))) [0 .e. 2 ^ (ptBits - objBits makeObject) - 1]) (ksPSpace a)) else (\<lambda>_. True)) s
 9. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = None \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) else (\<lambda>_. True)) s
 10. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (11 subgoals):
 1. \<And>s. \<lbrakk>toAPIType SmallPageObject = None; ty = SmallPageObject; \<not> d; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits SmallPageObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; ptr && mask (objBitsKO KOUserData) = 0\<rbrakk> \<Longrightarrow> vs_entry_align KOUserData = 0
 2. \<And>s. \<lbrakk>toAPIType SmallPageObject = None; ty = SmallPageObject; \<not> d; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits SmallPageObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; ptr && mask (objBitsKO KOUserData) = 0\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr (APIType_capBits SmallPageObject us) s
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = LargePageObject; d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 4) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xF]) (ksPSpace a)) else (\<lambda>_. True)) s
 4. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = LargePageObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData + 4) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xF]) (ksPSpace a)) else (\<lambda>_. True)) s
 5. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SectionObject; d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 8) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 6. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SectionObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData + 8) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 7. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SuperSectionObject; d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 8. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SuperSectionObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 9. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject)) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPTE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPTE makeObject)))) [0 .e. 2 ^ (ptBits - objBits makeObject) - 1]) (ksPSpace a)) else (\<lambda>_. True)) s
 10. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = None \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) else (\<lambda>_. True)) s
A total of 11 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>s. \<lbrakk>toAPIType LargePageObject = None; ty = LargePageObject; d; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits LargePageObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits LargePageObject us); ptr && mask (objBitsKO KOUserDataDevice + 4) = 0\<rbrakk> \<Longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xF]) (ksPSpace s))
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = LargePageObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData + 4) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xF]) (ksPSpace a)) else (\<lambda>_. True)) s
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SectionObject; d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 8) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 4. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SectionObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData + 8) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 5. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SuperSectionObject; d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 6. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SuperSectionObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 7. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject)) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPTE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPTE makeObject)))) [0 .e. 2 ^ (ptBits - objBits makeObject) - 1]) (ksPSpace a)) else (\<lambda>_. True)) s
 8. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = None \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) else (\<lambda>_. True)) s
 9. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (8 subgoals):
 1. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = LargePageObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData + 4) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xF]) (ksPSpace a)) else (\<lambda>_. True)) s
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SectionObject; d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 8) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SectionObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData + 8) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 4. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SuperSectionObject; d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 5. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SuperSectionObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 6. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject)) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPTE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPTE makeObject)))) [0 .e. 2 ^ (ptBits - objBits makeObject) - 1]) (ksPSpace a)) else (\<lambda>_. True)) s
 7. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = None \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) else (\<lambda>_. True)) s
 8. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (7 subgoals):
 1. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SectionObject; d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 8) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SectionObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData + 8) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SuperSectionObject; d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 4. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SuperSectionObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 5. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject)) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPTE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPTE makeObject)))) [0 .e. 2 ^ (ptBits - objBits makeObject) - 1]) (ksPSpace a)) else (\<lambda>_. True)) s
 6. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = None \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) else (\<lambda>_. True)) s
 7. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (6 subgoals):
 1. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SectionObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData + 8) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SuperSectionObject; d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SuperSectionObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 4. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject)) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPTE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPTE makeObject)))) [0 .e. 2 ^ (ptBits - objBits makeObject) - 1]) (ksPSpace a)) else (\<lambda>_. True)) s
 5. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = None \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) else (\<lambda>_. True)) s
 6. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (6 subgoals):
 1. \<And>s. \<lbrakk>toAPIType SectionObject = None; ty = SectionObject; \<not> d; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits SectionObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits SectionObject us); ptr && mask (objBitsKO KOUserData + 8) = 0\<rbrakk> \<Longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (new_cap_addrs 256 ptr KOUserData) (ksPSpace s))
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SuperSectionObject; d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SuperSectionObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 4. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject)) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPTE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPTE makeObject)))) [0 .e. 2 ^ (ptBits - objBits makeObject) - 1]) (ksPSpace a)) else (\<lambda>_. True)) s
 5. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = None \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) else (\<lambda>_. True)) s
 6. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (9 subgoals):
 1. \<And>s. \<lbrakk>toAPIType SectionObject = None; ty = SectionObject; \<not> d; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits SectionObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits SectionObject us); ptr && mask (objBitsKO KOUserData + 8) = 0\<rbrakk> \<Longrightarrow> is_aligned ptr (objBitsKO KOUserData + 8)
 2. \<And>s. \<lbrakk>toAPIType SectionObject = None; ty = SectionObject; \<not> d; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits SectionObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits SectionObject us); ptr && mask (objBitsKO KOUserData + 8) = 0\<rbrakk> \<Longrightarrow> vs_entry_align KOUserData \<le> 8
 3. \<And>s. \<lbrakk>toAPIType SectionObject = None; ty = SectionObject; \<not> d; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits SectionObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits SectionObject us); ptr && mask (objBitsKO KOUserData + 8) = 0\<rbrakk> \<Longrightarrow> objBitsKO KOUserData < 24
 4. \<And>s. \<lbrakk>toAPIType SectionObject = None; ty = SectionObject; \<not> d; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits SectionObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits SectionObject us); ptr && mask (objBitsKO KOUserData + 8) = 0\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (new_cap_addrs 256 ptr KOUserData). ksPSpace s x = None
 5. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SuperSectionObject; d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 6. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SuperSectionObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 7. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject)) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPTE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPTE makeObject)))) [0 .e. 2 ^ (ptBits - objBits makeObject) - 1]) (ksPSpace a)) else (\<lambda>_. True)) s
 8. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = None \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) else (\<lambda>_. True)) s
 9. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (6 subgoals):
 1. \<And>s. \<lbrakk>ty = SectionObject; \<not> d; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr 20 s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr 20; ptr && mask 20 = 0\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (new_cap_addrs 256 ptr KOUserData). ksPSpace s x = None
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SuperSectionObject; d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SuperSectionObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 4. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject)) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPTE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPTE makeObject)))) [0 .e. 2 ^ (ptBits - objBits makeObject) - 1]) (ksPSpace a)) else (\<lambda>_. True)) s
 5. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = None \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) else (\<lambda>_. True)) s
 6. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (5 subgoals):
 1. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SuperSectionObject; d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserDataDevice + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (map (\<lambda>n. ptr + (n << objBitsKO KOUserDataDevice)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SuperSectionObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject)) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPTE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPTE makeObject)))) [0 .e. 2 ^ (ptBits - objBits makeObject) - 1]) (ksPSpace a)) else (\<lambda>_. True)) s
 4. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = None \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) else (\<lambda>_. True)) s
 5. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (5 subgoals):
 1. \<And>s. \<lbrakk>toAPIType SuperSectionObject = None; ty = SuperSectionObject; d; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits SuperSectionObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits SuperSectionObject us); ptr && mask (objBitsKO KOUserDataDevice + 12) = 0\<rbrakk> \<Longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserDataDevice) (new_cap_addrs 4096 ptr KOUserDataDevice) (ksPSpace s))
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SuperSectionObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject)) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPTE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPTE makeObject)))) [0 .e. 2 ^ (ptBits - objBits makeObject) - 1]) (ksPSpace a)) else (\<lambda>_. True)) s
 4. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = None \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) else (\<lambda>_. True)) s
 5. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (8 subgoals):
 1. \<And>s. \<lbrakk>toAPIType SuperSectionObject = None; ty = SuperSectionObject; d; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits SuperSectionObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits SuperSectionObject us); ptr && mask (objBitsKO KOUserDataDevice + 12) = 0\<rbrakk> \<Longrightarrow> is_aligned ptr (objBitsKO KOUserDataDevice + 12)
 2. \<And>s. \<lbrakk>toAPIType SuperSectionObject = None; ty = SuperSectionObject; d; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits SuperSectionObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits SuperSectionObject us); ptr && mask (objBitsKO KOUserDataDevice + 12) = 0\<rbrakk> \<Longrightarrow> vs_entry_align KOUserDataDevice \<le> 12
 3. \<And>s. \<lbrakk>toAPIType SuperSectionObject = None; ty = SuperSectionObject; d; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits SuperSectionObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits SuperSectionObject us); ptr && mask (objBitsKO KOUserDataDevice + 12) = 0\<rbrakk> \<Longrightarrow> objBitsKO KOUserDataDevice < 20
 4. \<And>s. \<lbrakk>toAPIType SuperSectionObject = None; ty = SuperSectionObject; d; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits SuperSectionObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits SuperSectionObject us); ptr && mask (objBitsKO KOUserDataDevice + 12) = 0\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (new_cap_addrs 4096 ptr KOUserDataDevice). ksPSpace s x = None
 5. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SuperSectionObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 6. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject)) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPTE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPTE makeObject)))) [0 .e. 2 ^ (ptBits - objBits makeObject) - 1]) (ksPSpace a)) else (\<lambda>_. True)) s
 7. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = None \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) else (\<lambda>_. True)) s
 8. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (5 subgoals):
 1. \<And>s. \<lbrakk>ty = SuperSectionObject; d; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr 24 s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr 24; ptr && mask 24 = 0\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (new_cap_addrs 4096 ptr KOUserDataDevice). ksPSpace s x = None
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SuperSectionObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject)) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPTE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPTE makeObject)))) [0 .e. 2 ^ (ptBits - objBits makeObject) - 1]) (ksPSpace a)) else (\<lambda>_. True)) s
 4. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = None \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) else (\<lambda>_. True)) s
 5. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = SuperSectionObject; \<not> d\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO KOUserData + 12) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (map (\<lambda>n. ptr + (n << objBitsKO KOUserData)) [0 .e. 0xFFF]) (ksPSpace a)) else (\<lambda>_. True)) s
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject)) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPTE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPTE makeObject)))) [0 .e. 2 ^ (ptBits - objBits makeObject) - 1]) (ksPSpace a)) else (\<lambda>_. True)) s
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = None \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) else (\<lambda>_. True)) s
 4. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>toAPIType SuperSectionObject = None; ty = SuperSectionObject; \<not> d; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits SuperSectionObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits SuperSectionObject us); ptr && mask (objBitsKO KOUserData + 12) = 0\<rbrakk> \<Longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr KOUserData) (new_cap_addrs 4096 ptr KOUserData) (ksPSpace s))
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject)) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPTE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPTE makeObject)))) [0 .e. 2 ^ (ptBits - objBits makeObject) - 1]) (ksPSpace a)) else (\<lambda>_. True)) s
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = None \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) else (\<lambda>_. True)) s
 4. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (7 subgoals):
 1. \<And>s. \<lbrakk>toAPIType SuperSectionObject = None; ty = SuperSectionObject; \<not> d; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits SuperSectionObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits SuperSectionObject us); ptr && mask (objBitsKO KOUserData + 12) = 0\<rbrakk> \<Longrightarrow> is_aligned ptr (objBitsKO KOUserData + 12)
 2. \<And>s. \<lbrakk>toAPIType SuperSectionObject = None; ty = SuperSectionObject; \<not> d; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits SuperSectionObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits SuperSectionObject us); ptr && mask (objBitsKO KOUserData + 12) = 0\<rbrakk> \<Longrightarrow> vs_entry_align KOUserData \<le> 12
 3. \<And>s. \<lbrakk>toAPIType SuperSectionObject = None; ty = SuperSectionObject; \<not> d; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits SuperSectionObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits SuperSectionObject us); ptr && mask (objBitsKO KOUserData + 12) = 0\<rbrakk> \<Longrightarrow> objBitsKO KOUserData < 20
 4. \<And>s. \<lbrakk>toAPIType SuperSectionObject = None; ty = SuperSectionObject; \<not> d; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits SuperSectionObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits SuperSectionObject us); ptr && mask (objBitsKO KOUserData + 12) = 0\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (new_cap_addrs 4096 ptr KOUserData). ksPSpace s x = None
 5. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject)) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPTE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPTE makeObject)))) [0 .e. 2 ^ (ptBits - objBits makeObject) - 1]) (ksPSpace a)) else (\<lambda>_. True)) s
 6. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = None \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) else (\<lambda>_. True)) s
 7. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>ty = SuperSectionObject; \<not> d; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr 24 s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr 24; ptr && mask 24 = 0\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (new_cap_addrs 4096 ptr KOUserData). ksPSpace s x = None
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject)) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPTE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPTE makeObject)))) [0 .e. 2 ^ (ptBits - objBits makeObject) - 1]) (ksPSpace a)) else (\<lambda>_. True)) s
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = None \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) else (\<lambda>_. True)) s
 4. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPTE makeObject)) + (ptBits - objBits makeObject)) = 0 then \<lambda>a. vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPTE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPTE makeObject)))) [0 .e. 2 ^ (ptBits - objBits makeObject) - 1]) (ksPSpace a)) else (\<lambda>_. True)) s
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = None \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) else (\<lambda>_. True)) s
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>toAPIType PageTableObject = None; ty = PageTableObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits PageTableObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits PageTableObject us); ptr && mask (pteBits + 8) = 0\<rbrakk> \<Longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPTE makeObject))) (map (\<lambda>n. ptr + (n << pteBits)) [0 .e. 0xFF]) (ksPSpace s))
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = None \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) else (\<lambda>_. True)) s
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>toAPIType PageTableObject = None; ty = PageTableObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits PageTableObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits PageTableObject us); ptr && mask (pteBits + 8) = 0\<rbrakk> \<Longrightarrow> 1 \<le> 0x100
 2. \<And>s. \<lbrakk>toAPIType PageTableObject = None; ty = PageTableObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits PageTableObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits PageTableObject us); ptr && mask (pteBits + 8) = 0; map (\<lambda>n. ptr + (n << (case KOArch (KOPTE makeObject) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits))) [0 .e. 0x100 - 1] = new_cap_addrs (unat 0x100) ptr (KOArch (KOPTE makeObject))\<rbrakk> \<Longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPTE makeObject))) (map (\<lambda>n. ptr + (n << pteBits)) [0 .e. 0xFF]) (ksPSpace s))
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = None \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) else (\<lambda>_. True)) s
 4. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>toAPIType PageTableObject = None; ty = PageTableObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits PageTableObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits PageTableObject us); ptr && mask (pteBits + 8) = 0; map (\<lambda>n. ptr + (n << (case KOArch (KOPTE makeObject) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits))) [0 .e. 0x100 - 1] = new_cap_addrs (unat 0x100) ptr (KOArch (KOPTE makeObject))\<rbrakk> \<Longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPTE makeObject))) (map (\<lambda>n. ptr + (n << pteBits)) [0 .e. 0xFF]) (ksPSpace s))
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = None \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) else (\<lambda>_. True)) s
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>toAPIType PageTableObject = None; ty = PageTableObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits PageTableObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits PageTableObject us); ptr && mask (pteBits + 8) = 0; map (\<lambda>n. ptr + (n << pteBits)) [0 .e. 0xFF] = new_cap_addrs 256 ptr (KOArch (KOPTE makeObject))\<rbrakk> \<Longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPTE makeObject))) (new_cap_addrs 256 ptr (KOArch (KOPTE makeObject))) (ksPSpace s))
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = None \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) else (\<lambda>_. True)) s
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (6 subgoals):
 1. \<And>s. \<lbrakk>toAPIType PageTableObject = None; ty = PageTableObject; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits PageTableObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits PageTableObject us); ptr && mask (pteBits + 8) = 0; map (\<lambda>n. ptr + (n << pteBits)) [0 .e. 0xFF] = new_cap_addrs 256 ptr (KOArch (KOPTE makeObject))\<rbrakk> \<Longrightarrow> is_aligned ptr (objBitsKO (KOArch (KOPTE makeObject)) + 8)
 2. \<And>s. \<lbrakk>toAPIType PageTableObject = None; ty = PageTableObject; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits PageTableObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits PageTableObject us); ptr && mask (pteBits + 8) = 0; map (\<lambda>n. ptr + (n << pteBits)) [0 .e. 0xFF] = new_cap_addrs 256 ptr (KOArch (KOPTE makeObject))\<rbrakk> \<Longrightarrow> vs_entry_align (KOArch (KOPTE makeObject)) \<le> 8
 3. \<And>s. \<lbrakk>toAPIType PageTableObject = None; ty = PageTableObject; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits PageTableObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits PageTableObject us); ptr && mask (pteBits + 8) = 0; map (\<lambda>n. ptr + (n << pteBits)) [0 .e. 0xFF] = new_cap_addrs 256 ptr (KOArch (KOPTE makeObject))\<rbrakk> \<Longrightarrow> objBitsKO (KOArch (KOPTE makeObject)) < 24
 4. \<And>s. \<lbrakk>toAPIType PageTableObject = None; ty = PageTableObject; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits PageTableObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits PageTableObject us); ptr && mask (pteBits + 8) = 0; map (\<lambda>n. ptr + (n << pteBits)) [0 .e. 0xFF] = new_cap_addrs 256 ptr (KOArch (KOPTE makeObject))\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (new_cap_addrs 256 ptr (KOArch (KOPTE makeObject))). ksPSpace s x = None
 5. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = None \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) else (\<lambda>_. True)) s
 6. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>ty = PageTableObject; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr 10 s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr 10; ptr && mask 10 = 0; map (\<lambda>n. ptr + (n << 2)) [0 .e. 0xFF] = new_cap_addrs 256 ptr (KOArch (KOPTE makeObject))\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (new_cap_addrs 256 ptr (KOArch (KOPTE makeObject))). ksPSpace s x = None
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = None \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) else (\<lambda>_. True)) s
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = None; ty = PageDirectoryObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = None \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and K (is_aligned ptr pdBits)) (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>)) else (\<lambda>_. True)) s
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits PageDirectoryObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits PageDirectoryObject us); ptr && mask (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) = 0\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)) \<and> pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>) \<and> pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>) \<and> is_aligned ptr pdBits) \<and> (\<forall>a. (\<exists>b. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = Some (a, b)) \<longrightarrow> a < ptr \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)) \<and> pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>) \<and> pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>) \<and> is_aligned ptr pdBits)
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits PageDirectoryObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits PageDirectoryObject us); ptr && mask (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) = 0\<rbrakk> \<Longrightarrow> 1 \<le> 0x1000
 2. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits PageDirectoryObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits PageDirectoryObject us); ptr && mask (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) = 0; map (\<lambda>n. ptr + (n << (case KOArch (KOPDE makeObject) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits))) [0 .e. 0x1000 - 1] = new_cap_addrs (unat 0x1000) ptr (KOArch (KOPDE makeObject))\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)) \<and> pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>) \<and> pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>) \<and> is_aligned ptr pdBits) \<and> (\<forall>a. (\<exists>b. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = Some (a, b)) \<longrightarrow> a < ptr \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)) \<and> pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>) \<and> pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>) \<and> is_aligned ptr pdBits)
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits PageDirectoryObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits PageDirectoryObject us); ptr && mask (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) = 0; map (\<lambda>n. ptr + (n << (case KOArch (KOPDE makeObject) of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits))) [0 .e. 0x1000 - 1] = new_cap_addrs (unat 0x1000) ptr (KOArch (KOPDE makeObject))\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)) \<and> pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>) \<and> pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>) \<and> is_aligned ptr pdBits) \<and> (\<forall>a. (\<exists>b. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOArch (KOPDE makeObject)) + (pdBits - objBits makeObject)) - 1)) (ksPSpace s)) = Some (a, b)) \<longrightarrow> a < ptr \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)) \<and> pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>) \<and> pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << objBitsKO (KOArch (KOPDE makeObject)))) [0 .e. 2 ^ (pdBits - objBits makeObject) - 1]) (ksPSpace s)\<rparr>) \<and> is_aligned ptr pdBits)
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits PageDirectoryObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) (12 + pdeBits); is_aligned ptr (APIType_capBits PageDirectoryObject us); ptr && mask (pdeBits + 12) = 0; map (\<lambda>n. ptr + (n << pdeBits)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + (2 ^ (pdeBits + 12) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)) \<and> pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>) \<and> pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>) \<and> is_aligned ptr (12 + pdeBits)) \<and> (\<forall>a. (\<exists>b. fst (lookupAround2 (ptr + (2 ^ (pdeBits + 12) - 1)) (ksPSpace s)) = Some (a, b)) \<longrightarrow> a < ptr \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)) \<and> pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>) \<and> pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>) \<and> is_aligned ptr (12 + pdeBits))
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits PageDirectoryObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) (12 + pdeBits); is_aligned ptr (APIType_capBits PageDirectoryObject us); ptr && mask (pdeBits + 12) = 0; map (\<lambda>n. ptr + (n << pdeBits)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))\<rbrakk> \<Longrightarrow> range_cover ptr (APIType_capBits PageDirectoryObject us) (objBitsKO (KOArch (KOPDE makeObject))) 4096
 2. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits PageDirectoryObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) (12 + pdeBits); is_aligned ptr (APIType_capBits PageDirectoryObject us); ptr && mask (pdeBits + 12) = 0; map (\<lambda>n. ptr + (n << pdeBits)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject)); pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>)\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + (2 ^ (pdeBits + 12) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)) \<and> pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>) \<and> pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>) \<and> is_aligned ptr (12 + pdeBits)) \<and> (\<forall>a. (\<exists>b. fst (lookupAround2 (ptr + (2 ^ (pdeBits + 12) - 1)) (ksPSpace s)) = Some (a, b)) \<longrightarrow> a < ptr \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)) \<and> pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>) \<and> pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>) \<and> is_aligned ptr (12 + pdeBits))
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits PageDirectoryObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) (12 + pdeBits); is_aligned ptr (APIType_capBits PageDirectoryObject us); ptr && mask (pdeBits + 12) = 0; map (\<lambda>n. ptr + (n << pdeBits)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))\<rbrakk> \<Longrightarrow> range_cover ptr (APIType_capBits PageDirectoryObject us) pdeBits 4096
 2. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits PageDirectoryObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) (12 + pdeBits); is_aligned ptr (APIType_capBits PageDirectoryObject us); ptr && mask (pdeBits + 12) = 0; map (\<lambda>n. ptr + (n << pdeBits)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject)); pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>)\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + (2 ^ (pdeBits + 12) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)) \<and> pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>) \<and> pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>) \<and> is_aligned ptr (12 + pdeBits)) \<and> (\<forall>a. (\<exists>b. fst (lookupAround2 (ptr + (2 ^ (pdeBits + 12) - 1)) (ksPSpace s)) = Some (a, b)) \<longrightarrow> a < ptr \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)) \<and> pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>) \<and> pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>) \<and> is_aligned ptr (12 + pdeBits))
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (6 subgoals):
 1. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits PageDirectoryObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) (12 + pdeBits); is_aligned ptr (APIType_capBits PageDirectoryObject us); ptr && mask (pdeBits + 12) = 0; map (\<lambda>n. ptr + (n << pdeBits)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))\<rbrakk> \<Longrightarrow> is_aligned ptr (APIType_capBits PageDirectoryObject us)
 2. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits PageDirectoryObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) (12 + pdeBits); is_aligned ptr (APIType_capBits PageDirectoryObject us); ptr && mask (pdeBits + 12) = 0; map (\<lambda>n. ptr + (n << pdeBits)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))\<rbrakk> \<Longrightarrow> APIType_capBits PageDirectoryObject us < word_bits
 3. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits PageDirectoryObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) (12 + pdeBits); is_aligned ptr (APIType_capBits PageDirectoryObject us); ptr && mask (pdeBits + 12) = 0; map (\<lambda>n. ptr + (n << pdeBits)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))\<rbrakk> \<Longrightarrow> pdeBits \<le> APIType_capBits PageDirectoryObject us
 4. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits PageDirectoryObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) (12 + pdeBits); is_aligned ptr (APIType_capBits PageDirectoryObject us); ptr && mask (pdeBits + 12) = 0; map (\<lambda>n. ptr + (n << pdeBits)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))\<rbrakk> \<Longrightarrow> 4096 = 2 ^ (APIType_capBits PageDirectoryObject us - pdeBits) * Suc 0
 5. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits PageDirectoryObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) (12 + pdeBits); is_aligned ptr (APIType_capBits PageDirectoryObject us); ptr && mask (pdeBits + 12) = 0; map (\<lambda>n. ptr + (n << pdeBits)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject)); pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>)\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + (2 ^ (pdeBits + 12) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)) \<and> pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>) \<and> pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>) \<and> is_aligned ptr (12 + pdeBits)) \<and> (\<forall>a. (\<exists>b. fst (lookupAround2 (ptr + (2 ^ (pdeBits + 12) - 1)) (ksPSpace s)) = Some (a, b)) \<longrightarrow> a < ptr \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)) \<and> pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>) \<and> pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>) \<and> is_aligned ptr (12 + pdeBits))
 6. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (5 subgoals):
 1. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits PageDirectoryObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) (12 + pdeBits); is_aligned ptr (APIType_capBits PageDirectoryObject us); ptr && mask (pdeBits + 12) = 0; map (\<lambda>n. ptr + (n << pdeBits)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))\<rbrakk> \<Longrightarrow> APIType_capBits PageDirectoryObject us < word_bits
 2. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits PageDirectoryObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) (12 + pdeBits); is_aligned ptr (APIType_capBits PageDirectoryObject us); ptr && mask (pdeBits + 12) = 0; map (\<lambda>n. ptr + (n << pdeBits)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))\<rbrakk> \<Longrightarrow> pdeBits \<le> APIType_capBits PageDirectoryObject us
 3. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits PageDirectoryObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) (12 + pdeBits); is_aligned ptr (APIType_capBits PageDirectoryObject us); ptr && mask (pdeBits + 12) = 0; map (\<lambda>n. ptr + (n << pdeBits)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))\<rbrakk> \<Longrightarrow> 4096 = 2 ^ (APIType_capBits PageDirectoryObject us - pdeBits) * Suc 0
 4. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits PageDirectoryObject us) s; is_aligned (armKSGlobalPD (ksArchState s)) (12 + pdeBits); is_aligned ptr (APIType_capBits PageDirectoryObject us); ptr && mask (pdeBits + 12) = 0; map (\<lambda>n. ptr + (n << pdeBits)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject)); pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>)\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + (2 ^ (pdeBits + 12) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)) \<and> pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>) \<and> pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>) \<and> is_aligned ptr (12 + pdeBits)) \<and> (\<forall>a. (\<exists>b. fst (lookupAround2 (ptr + (2 ^ (pdeBits + 12) - 1)) (ksPSpace s)) = Some (a, b)) \<longrightarrow> a < ptr \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)) \<and> pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>) \<and> pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>) \<and> is_aligned ptr (12 + pdeBits))
 5. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr 14 s; is_aligned (armKSGlobalPD (ksArchState s)) 14; is_aligned ptr 14; ptr && mask 14 = 0; map (\<lambda>n. ptr + (n << 2)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject)); pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>)\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + 0x3FFF) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)) \<and> pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>)) \<and> (\<forall>a. (\<exists>b. fst (lookupAround2 (ptr + 0x3FFF) (ksPSpace s)) = Some (a, b)) \<longrightarrow> a < ptr \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)) \<and> pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>))
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr 14 s; is_aligned (armKSGlobalPD (ksArchState s)) 14; is_aligned ptr 14; ptr && mask 14 = 0; map (\<lambda>n. ptr + (n << 2)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject)); pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>)\<rbrakk> \<Longrightarrow> range_cover ptr 14 (objBitsKO (KOArch (KOPDE makeObject))) 4096
 2. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr 14 s; is_aligned (armKSGlobalPD (ksArchState s)) 14; is_aligned ptr 14; ptr && mask 14 = 0; map (\<lambda>n. ptr + (n << 2)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject)); pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>); pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>)\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + 0x3FFF) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)) \<and> pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>)) \<and> (\<forall>a. (\<exists>b. fst (lookupAround2 (ptr + 0x3FFF) (ksPSpace s)) = Some (a, b)) \<longrightarrow> a < ptr \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)) \<and> pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>))
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr 14 s; is_aligned (armKSGlobalPD (ksArchState s)) 14; is_aligned ptr 14; ptr && mask 14 = 0; map (\<lambda>n. ptr + (n << 2)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject)); pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>)\<rbrakk> \<Longrightarrow> range_cover ptr 14 pdeBits 4096
 2. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr 14 s; is_aligned (armKSGlobalPD (ksArchState s)) 14; is_aligned ptr 14; ptr && mask 14 = 0; map (\<lambda>n. ptr + (n << 2)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject)); pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>); pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>)\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + 0x3FFF) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)) \<and> pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>)) \<and> (\<forall>a. (\<exists>b. fst (lookupAround2 (ptr + 0x3FFF) (ksPSpace s)) = Some (a, b)) \<longrightarrow> a < ptr \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)) \<and> pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>))
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (6 subgoals):
 1. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr 14 s; is_aligned (armKSGlobalPD (ksArchState s)) 14; is_aligned ptr 14; ptr && mask 14 = 0; map (\<lambda>n. ptr + (n << 2)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject)); pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>)\<rbrakk> \<Longrightarrow> is_aligned ptr 14
 2. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr 14 s; is_aligned (armKSGlobalPD (ksArchState s)) 14; is_aligned ptr 14; ptr && mask 14 = 0; map (\<lambda>n. ptr + (n << 2)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject)); pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>)\<rbrakk> \<Longrightarrow> 14 < word_bits
 3. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr 14 s; is_aligned (armKSGlobalPD (ksArchState s)) 14; is_aligned ptr 14; ptr && mask 14 = 0; map (\<lambda>n. ptr + (n << 2)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject)); pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>)\<rbrakk> \<Longrightarrow> pdeBits \<le> 14
 4. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr 14 s; is_aligned (armKSGlobalPD (ksArchState s)) 14; is_aligned ptr 14; ptr && mask 14 = 0; map (\<lambda>n. ptr + (n << 2)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject)); pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>)\<rbrakk> \<Longrightarrow> 4096 = 2 ^ (14 - pdeBits) * Suc 0
 5. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr 14 s; is_aligned (armKSGlobalPD (ksArchState s)) 14; is_aligned ptr 14; ptr && mask 14 = 0; map (\<lambda>n. ptr + (n << 2)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject)); pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>); pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>)\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + 0x3FFF) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)) \<and> pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>)) \<and> (\<forall>a. (\<exists>b. fst (lookupAround2 (ptr + 0x3FFF) (ksPSpace s)) = Some (a, b)) \<longrightarrow> a < ptr \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)) \<and> pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>))
 6. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (5 subgoals):
 1. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr 14 s; is_aligned (armKSGlobalPD (ksArchState s)) 14; is_aligned ptr 14; ptr && mask 14 = 0; map (\<lambda>n. ptr + (n << 2)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject)); pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>)\<rbrakk> \<Longrightarrow> 14 < word_bits
 2. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr 14 s; is_aligned (armKSGlobalPD (ksArchState s)) 14; is_aligned ptr 14; ptr && mask 14 = 0; map (\<lambda>n. ptr + (n << 2)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject)); pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>)\<rbrakk> \<Longrightarrow> pdeBits \<le> 14
 3. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr 14 s; is_aligned (armKSGlobalPD (ksArchState s)) 14; is_aligned ptr 14; ptr && mask 14 = 0; map (\<lambda>n. ptr + (n << 2)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject)); pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>)\<rbrakk> \<Longrightarrow> 4096 = 2 ^ (14 - pdeBits) * Suc 0
 4. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr 14 s; is_aligned (armKSGlobalPD (ksArchState s)) 14; is_aligned ptr 14; ptr && mask 14 = 0; map (\<lambda>n. ptr + (n << 2)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject)); pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>); pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>)\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + 0x3FFF) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)) \<and> pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>)) \<and> (\<forall>a. (\<exists>b. fst (lookupAround2 (ptr + 0x3FFF) (ksPSpace s)) = Some (a, b)) \<longrightarrow> a < ptr \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)) \<and> pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>))
 5. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr 14 s; is_aligned (armKSGlobalPD (ksArchState s)) 14; is_aligned ptr 14; ptr && mask 14 = 0; map (\<lambda>n. ptr + (n << 2)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject)); pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>); pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>)\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + 0x3FFF) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s))) \<and> (\<forall>a. (\<exists>b. fst (lookupAround2 (ptr + 0x3FFF) (ksPSpace s)) = Some (a, b)) \<longrightarrow> a < ptr \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)))
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr 14 s; is_aligned (armKSGlobalPD (ksArchState s)) 14; is_aligned ptr 14; ptr && mask 14 = 0; map (\<lambda>n. ptr + (n << 2)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject)); pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>); pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>); vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << 2)) [0 .e. 2 ^ (pdBits - 2) - 1]) (ksPSpace s))\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + 0x3FFF) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s))) \<and> (\<forall>a. (\<exists>b. fst (lookupAround2 (ptr + 0x3FFF) (ksPSpace s)) = Some (a, b)) \<longrightarrow> a < ptr \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)))
 2. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr 14 s; is_aligned (armKSGlobalPD (ksArchState s)) 14; is_aligned ptr 14; ptr && mask 14 = 0; map (\<lambda>n. ptr + (n << 2)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject)); pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>); pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>)\<rbrakk> \<Longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << 2)) [0 .e. 2 ^ (pdBits - 2) - 1]) (ksPSpace s))
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr 14 s; is_aligned (armKSGlobalPD (ksArchState s)) 14; is_aligned ptr 14; ptr && mask 14 = 0; map (\<lambda>n. ptr + (n << 2)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject)); pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>); pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>)\<rbrakk> \<Longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (map (\<lambda>n. ptr + (n << 2)) [0 .e. 2 ^ (pdBits - 2) - 1]) (ksPSpace s))
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr 14 s; is_aligned (armKSGlobalPD (ksArchState s)) 14; is_aligned ptr 14; ptr && mask 14 = 0; map (\<lambda>n. ptr + (n << 2)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject)); pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>); pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>)\<rbrakk> \<Longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s))
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (6 subgoals):
 1. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr 14 s; is_aligned (armKSGlobalPD (ksArchState s)) 14; is_aligned ptr 14; ptr && mask 14 = 0; map (\<lambda>n. ptr + (n << 2)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject)); pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>); pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>)\<rbrakk> \<Longrightarrow> vs_valid_duplicates' (ksPSpace s)
 2. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr 14 s; is_aligned (armKSGlobalPD (ksArchState s)) 14; is_aligned ptr 14; ptr && mask 14 = 0; map (\<lambda>n. ptr + (n << 2)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject)); pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>); pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>)\<rbrakk> \<Longrightarrow> is_aligned ptr (objBitsKO (KOArch (KOPDE makeObject)) + 12)
 3. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr 14 s; is_aligned (armKSGlobalPD (ksArchState s)) 14; is_aligned ptr 14; ptr && mask 14 = 0; map (\<lambda>n. ptr + (n << 2)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject)); pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>); pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>)\<rbrakk> \<Longrightarrow> vs_entry_align (KOArch (KOPDE makeObject)) \<le> 12
 4. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr 14 s; is_aligned (armKSGlobalPD (ksArchState s)) 14; is_aligned ptr 14; ptr && mask 14 = 0; map (\<lambda>n. ptr + (n << 2)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject)); pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>); pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>)\<rbrakk> \<Longrightarrow> objBitsKO (KOArch (KOPDE makeObject)) < 20
 5. \<And>s. \<lbrakk>toAPIType PageDirectoryObject = None; ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr 14 s; is_aligned (armKSGlobalPD (ksArchState s)) 14; is_aligned ptr 14; ptr && mask 14 = 0; map (\<lambda>n. ptr + (n << 2)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject)); pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>); pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))). ksPSpace s x = None
 6. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>ty = PageDirectoryObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr 14 s; is_aligned (armKSGlobalPD (ksArchState s)) 14; is_aligned ptr 14; ptr && mask 14 = 0; map (\<lambda>n. ptr + (n << 2)) [0 .e. 0xFFF] = new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject)); pspace_distinct' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>); pspace_aligned' (s\<lparr>ksPSpace := foldr (\<lambda>addr. data_map_insert addr (KOArch (KOPDE makeObject))) (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))) (ksPSpace s)\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (new_cap_addrs 4096 ptr (KOArch (KOPDE makeObject))). ksPSpace s x = None
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s\<rbrakk> \<Longrightarrow> \<forall>x. toAPIType ty = Some x \<longrightarrow> (x = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> vs_valid_duplicates' (ksPSpace s)) \<and> (x = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s) \<and> (x = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s) proof (prove)
goal (5 subgoals):
 1. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.Untyped\<rbrakk> \<Longrightarrow> vs_valid_duplicates' (ksPSpace s)
 2. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s
 3. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s
 4. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s
 5. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s proof (prove)
goal (4 subgoals):
 1. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOTCB makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOTCB makeObject)\<rparr>))) else (\<lambda>_. True)) s
 2. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s
 3. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s
 4. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; toAPIType ty = Some ArchTypes_H.apiobject_type.TCBObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits ty us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits ty us); ptr && mask (objBitsKO (KOTCB makeObject)) = 0\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (\<lambda>a. if a = ptr then Some (KOTCB makeObject) else ksPSpace s a)) \<and> (\<forall>a. (\<exists>b. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some (a, b)) \<longrightarrow> a < ptr \<longrightarrow> vs_valid_duplicates' (\<lambda>a. if a = ptr then Some (KOTCB makeObject) else ksPSpace s a))
 2. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s
 3. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s
 4. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s proof (prove)
goal (6 subgoals):
 1. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; toAPIType ty = Some ArchTypes_H.apiobject_type.TCBObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits ty us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; ptr && mask (objBitsKO (KOTCB makeObject)) = 0\<rbrakk> \<Longrightarrow> vs_entry_align (?ko891 s) = 0
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; toAPIType ty = Some ArchTypes_H.apiobject_type.TCBObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits ty us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; ptr && mask (objBitsKO (KOTCB makeObject)) = 0\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr (APIType_capBits ty us) s
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; toAPIType ty = Some ArchTypes_H.apiobject_type.TCBObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits ty us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; ptr && mask (objBitsKO (KOTCB makeObject)) = 0; vs_valid_duplicates' (\<lambda>a. if a = ptr then Some (?ko891 s) else ksPSpace s a)\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (\<lambda>a. if a = ptr then Some (KOTCB makeObject) else ksPSpace s a)) \<and> (\<forall>a. (\<exists>b. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some (a, b)) \<longrightarrow> a < ptr \<longrightarrow> vs_valid_duplicates' (\<lambda>a. if a = ptr then Some (KOTCB makeObject) else ksPSpace s a))
 4. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s
 5. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s
 6. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s proof (prove)
goal (6 subgoals):
 1. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; toAPIType ty = Some ArchTypes_H.apiobject_type.TCBObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits ty us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; ptr && mask (objBitsKO (KOTCB makeObject)) = 0; vs_valid_duplicates' (\<lambda>a. if a = ptr then Some (?ko891 s) else ksPSpace s a)\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (\<lambda>a. if a = ptr then Some (KOTCB makeObject) else ksPSpace s a)) \<and> (\<forall>a. (\<exists>b. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOTCB makeObject) - 1)) (ksPSpace s)) = Some (a, b)) \<longrightarrow> a < ptr \<longrightarrow> vs_valid_duplicates' (\<lambda>a. if a = ptr then Some (KOTCB makeObject) else ksPSpace s a))
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; toAPIType ty = Some ArchTypes_H.apiobject_type.TCBObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits ty us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; ptr && mask (objBitsKO (KOTCB makeObject)) = 0\<rbrakk> \<Longrightarrow> vs_entry_align (?ko891 s) = 0
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; toAPIType ty = Some ArchTypes_H.apiobject_type.TCBObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits ty us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; ptr && mask (objBitsKO (KOTCB makeObject)) = 0\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr (APIType_capBits ty us) s
 4. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s
 5. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s
 6. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s proof (prove)
goal (5 subgoals):
 1. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; toAPIType ty = Some ArchTypes_H.apiobject_type.TCBObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits ty us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; ptr && mask (objBitsKO (KOTCB makeObject)) = 0\<rbrakk> \<Longrightarrow> vs_entry_align (KOTCB makeObject) = 0
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; toAPIType ty = Some ArchTypes_H.apiobject_type.TCBObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits ty us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; ptr && mask (objBitsKO (KOTCB makeObject)) = 0\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr (APIType_capBits ty us) s
 3. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s
 4. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s
 5. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; toAPIType ty = Some ArchTypes_H.apiobject_type.TCBObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits ty us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; ptr && mask (objBitsKO (KOTCB makeObject)) = 0\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr (APIType_capBits ty us) s
 2. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s
 3. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s
 4. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s proof (prove)
goal (3 subgoals):
 1. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KOEndpoint makeObject)\<rparr>))) else (\<lambda>_. True)) s
 2. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s
 3. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; toAPIType ty = Some ArchTypes_H.apiobject_type.EndpointObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits ty us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits ty us); ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (\<lambda>a. if a = ptr then Some (KOEndpoint makeObject) else ksPSpace s a)) \<and> (\<forall>a. (\<exists>b. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some (a, b)) \<longrightarrow> a < ptr \<longrightarrow> vs_valid_duplicates' (\<lambda>a. if a = ptr then Some (KOEndpoint makeObject) else ksPSpace s a))
 2. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s
 3. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s proof (prove)
goal (5 subgoals):
 1. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; toAPIType ty = Some ArchTypes_H.apiobject_type.EndpointObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits ty us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0\<rbrakk> \<Longrightarrow> vs_entry_align (?ko925 s) = 0
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; toAPIType ty = Some ArchTypes_H.apiobject_type.EndpointObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits ty us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr (APIType_capBits ty us) s
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; toAPIType ty = Some ArchTypes_H.apiobject_type.EndpointObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits ty us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0; vs_valid_duplicates' (\<lambda>a. if a = ptr then Some (?ko925 s) else ksPSpace s a)\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (\<lambda>a. if a = ptr then Some (KOEndpoint makeObject) else ksPSpace s a)) \<and> (\<forall>a. (\<exists>b. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some (a, b)) \<longrightarrow> a < ptr \<longrightarrow> vs_valid_duplicates' (\<lambda>a. if a = ptr then Some (KOEndpoint makeObject) else ksPSpace s a))
 4. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s
 5. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s proof (prove)
goal (5 subgoals):
 1. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; toAPIType ty = Some ArchTypes_H.apiobject_type.EndpointObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits ty us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0; vs_valid_duplicates' (\<lambda>a. if a = ptr then Some (?ko925 s) else ksPSpace s a)\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (\<lambda>a. if a = ptr then Some (KOEndpoint makeObject) else ksPSpace s a)) \<and> (\<forall>a. (\<exists>b. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KOEndpoint makeObject) - 1)) (ksPSpace s)) = Some (a, b)) \<longrightarrow> a < ptr \<longrightarrow> vs_valid_duplicates' (\<lambda>a. if a = ptr then Some (KOEndpoint makeObject) else ksPSpace s a))
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; toAPIType ty = Some ArchTypes_H.apiobject_type.EndpointObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits ty us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0\<rbrakk> \<Longrightarrow> vs_entry_align (?ko925 s) = 0
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; toAPIType ty = Some ArchTypes_H.apiobject_type.EndpointObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits ty us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; ptr && mask (objBitsKO (KOEndpoint makeObject)) = 0\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr (APIType_capBits ty us) s
 4. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s
 5. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s proof (prove)
goal (2 subgoals):
 1. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KONotification makeObject)) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := (ksPSpace s)(ptr \<mapsto> KONotification makeObject)\<rparr>))) else (\<lambda>_. True)) s
 2. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; toAPIType ty = Some ArchTypes_H.apiobject_type.NotificationObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits ty us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits ty us); ptr && mask (objBitsKO (KONotification makeObject)) = 0\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (\<lambda>a. if a = ptr then Some (KONotification makeObject) else ksPSpace s a)) \<and> (\<forall>a. (\<exists>b. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some (a, b)) \<longrightarrow> a < ptr \<longrightarrow> vs_valid_duplicates' (\<lambda>a. if a = ptr then Some (KONotification makeObject) else ksPSpace s a))
 2. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; toAPIType ty = Some ArchTypes_H.apiobject_type.NotificationObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits ty us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; ptr && mask (objBitsKO (KONotification makeObject)) = 0\<rbrakk> \<Longrightarrow> vs_entry_align (?ko964 s) = 0
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; toAPIType ty = Some ArchTypes_H.apiobject_type.NotificationObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits ty us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; ptr && mask (objBitsKO (KONotification makeObject)) = 0\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr (APIType_capBits ty us) s
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; toAPIType ty = Some ArchTypes_H.apiobject_type.NotificationObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits ty us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; ptr && mask (objBitsKO (KONotification makeObject)) = 0; vs_valid_duplicates' (\<lambda>a. if a = ptr then Some (?ko964 s) else ksPSpace s a)\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (\<lambda>a. if a = ptr then Some (KONotification makeObject) else ksPSpace s a)) \<and> (\<forall>a. (\<exists>b. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some (a, b)) \<longrightarrow> a < ptr \<longrightarrow> vs_valid_duplicates' (\<lambda>a. if a = ptr then Some (KONotification makeObject) else ksPSpace s a))
 4. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; toAPIType ty = Some ArchTypes_H.apiobject_type.NotificationObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits ty us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; ptr && mask (objBitsKO (KONotification makeObject)) = 0; vs_valid_duplicates' (\<lambda>a. if a = ptr then Some (?ko964 s) else ksPSpace s a)\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (\<lambda>a. if a = ptr then Some (KONotification makeObject) else ksPSpace s a)) \<and> (\<forall>a. (\<exists>b. fst (lookupAround2 (ptr + (2 ^ objBitsKO (KONotification makeObject) - 1)) (ksPSpace s)) = Some (a, b)) \<longrightarrow> a < ptr \<longrightarrow> vs_valid_duplicates' (\<lambda>a. if a = ptr then Some (KONotification makeObject) else ksPSpace s a))
 2. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; toAPIType ty = Some ArchTypes_H.apiobject_type.NotificationObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits ty us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; ptr && mask (objBitsKO (KONotification makeObject)) = 0\<rbrakk> \<Longrightarrow> vs_entry_align (?ko964 s) = 0
 3. \<And>s. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; toAPIType ty = Some ArchTypes_H.apiobject_type.NotificationObject; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits ty us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; ptr && mask (objBitsKO (KONotification makeObject)) = 0\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr (APIType_capBits ty us) s
 4. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s proof (prove)
goal (1 subgoal):
 1. \<And>s x. \<lbrakk>ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; ((\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct' and pspace_no_overlap' ptr (APIType_capBits ty us) and (\<lambda>s. is_aligned (armKSGlobalPD (ksArchState s)) pdBits) and (\<lambda>y. is_aligned ptr (APIType_capBits ty us))) s; toAPIType ty = Some x; x = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> (if ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0 then \<lambda>s. (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) \<and> (\<forall>x. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some x \<longrightarrow> fst x < ptr \<longrightarrow> vs_valid_duplicates' (ksPSpace (s\<lparr>ksPSpace := foldr (\<lambda>addr map. map(addr \<mapsto> KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s)\<rparr>))) else (\<lambda>_. True)) s proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>us < 28; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s))) \<and> (\<forall>a. (\<exists>b. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some (a, b)) \<longrightarrow> a < ptr \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s))) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>us < 28; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0\<rbrakk> \<Longrightarrow> 1 \<le> 2 ^ us
 2. \<And>s. \<lbrakk>us < 28; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0; map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1] = new_cap_addrs (unat (2 ^ us)) ptr (KOCTE makeObject)\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s))) \<and> (\<forall>a. (\<exists>b. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some (a, b)) \<longrightarrow> a < ptr \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s))) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>us < 28; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0\<rbrakk> \<Longrightarrow> us < LENGTH(32)
 2. \<And>s. \<lbrakk>us < 28; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0; map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1] = new_cap_addrs (unat (2 ^ us)) ptr (KOCTE makeObject)\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s))) \<and> (\<forall>a. (\<exists>b. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some (a, b)) \<longrightarrow> a < ptr \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s))) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>us < 28; vs_valid_duplicates' (ksPSpace s); pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0; map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1] = new_cap_addrs (unat (2 ^ us)) ptr (KOCTE makeObject)\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s))) \<and> (\<forall>a. (\<exists>b. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some (a, b)) \<longrightarrow> a < ptr \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s))) proof (prove)
goal (5 subgoals):
 1. \<And>s. \<lbrakk>us < 28; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0; map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1] = new_cap_addrs (unat (2 ^ us)) ptr (KOCTE makeObject)\<rbrakk> \<Longrightarrow> is_aligned ptr (objBitsKO (KOCTE makeObject) + us)
 2. \<And>s. \<lbrakk>us < 28; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0; map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1] = new_cap_addrs (unat (2 ^ us)) ptr (KOCTE makeObject)\<rbrakk> \<Longrightarrow> vs_entry_align (KOCTE makeObject) \<le> us
 3. \<And>s. \<lbrakk>us < 28; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0; map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1] = new_cap_addrs (unat (2 ^ us)) ptr (KOCTE makeObject)\<rbrakk> \<Longrightarrow> objBitsKO (KOCTE makeObject) + us < 32
 4. \<And>s. \<lbrakk>us < 28; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0; map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1] = new_cap_addrs (unat (2 ^ us)) ptr (KOCTE makeObject)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (new_cap_addrs (2 ^ us) ptr (KOCTE makeObject)). ksPSpace s x = None
 5. \<And>s. \<lbrakk>us < 28; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0; map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1] = new_cap_addrs (unat (2 ^ us)) ptr (KOCTE makeObject); vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOCTE makeObject)) (new_cap_addrs (2 ^ us) ptr (KOCTE makeObject)) (ksPSpace s))\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s))) \<and> (\<forall>a. (\<exists>b. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some (a, b)) \<longrightarrow> a < ptr \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s))) proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>us < 28; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0; map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1] = new_cap_addrs (unat (2 ^ us)) ptr (KOCTE makeObject)\<rbrakk> \<Longrightarrow> vs_entry_align (KOCTE makeObject) \<le> us
 2. \<And>s. \<lbrakk>us < 28; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0; map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1] = new_cap_addrs (unat (2 ^ us)) ptr (KOCTE makeObject)\<rbrakk> \<Longrightarrow> objBitsKO (KOCTE makeObject) + us < 32
 3. \<And>s. \<lbrakk>us < 28; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0; map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1] = new_cap_addrs (unat (2 ^ us)) ptr (KOCTE makeObject)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (new_cap_addrs (2 ^ us) ptr (KOCTE makeObject)). ksPSpace s x = None
 4. \<And>s. \<lbrakk>us < 28; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0; map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1] = new_cap_addrs (unat (2 ^ us)) ptr (KOCTE makeObject); vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOCTE makeObject)) (new_cap_addrs (2 ^ us) ptr (KOCTE makeObject)) (ksPSpace s))\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s))) \<and> (\<forall>a. (\<exists>b. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some (a, b)) \<longrightarrow> a < ptr \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s))) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>us < 28; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0; map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1] = new_cap_addrs (unat (2 ^ us)) ptr (KOCTE makeObject)\<rbrakk> \<Longrightarrow> objBitsKO (KOCTE makeObject) + us < 32
 2. \<And>s. \<lbrakk>us < 28; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0; map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1] = new_cap_addrs (unat (2 ^ us)) ptr (KOCTE makeObject)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (new_cap_addrs (2 ^ us) ptr (KOCTE makeObject)). ksPSpace s x = None
 3. \<And>s. \<lbrakk>us < 28; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0; map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1] = new_cap_addrs (unat (2 ^ us)) ptr (KOCTE makeObject); vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOCTE makeObject)) (new_cap_addrs (2 ^ us) ptr (KOCTE makeObject)) (ksPSpace s))\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s))) \<and> (\<forall>a. (\<exists>b. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some (a, b)) \<longrightarrow> a < ptr \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s))) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>us < 28; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0; map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1] = new_cap_addrs (unat (2 ^ us)) ptr (KOCTE makeObject)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (new_cap_addrs (2 ^ us) ptr (KOCTE makeObject)). ksPSpace s x = None
 2. \<And>s. \<lbrakk>us < 28; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0; map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1] = new_cap_addrs (unat (2 ^ us)) ptr (KOCTE makeObject); vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOCTE makeObject)) (new_cap_addrs (2 ^ us) ptr (KOCTE makeObject)) (ksPSpace s))\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s))) \<and> (\<forall>a. (\<exists>b. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some (a, b)) \<longrightarrow> a < ptr \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s))) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>us < 28; pspace_aligned' s; pspace_distinct' s; pspace_no_overlap' ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us) s; is_aligned (armKSGlobalPD (ksArchState s)) pdBits; is_aligned ptr (APIType_capBits (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) us); ty = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; ptr && mask (objBitsKO (KOCTE makeObject) + us) = 0; map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1] = new_cap_addrs (unat (2 ^ us)) ptr (KOCTE makeObject); vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOCTE makeObject)) (new_cap_addrs (2 ^ us) ptr (KOCTE makeObject)) (ksPSpace s))\<rbrakk> \<Longrightarrow> (fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = None \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s))) \<and> (\<forall>a. (\<exists>b. fst (lookupAround2 (ptr + (2 ^ (objBitsKO (KOCTE makeObject) + us) - 1)) (ksPSpace s)) = Some (a, b)) \<longrightarrow> a < ptr \<longrightarrow> vs_valid_duplicates' (foldr (\<lambda>addr. data_map_insert addr (KOCTE makeObject)) (map (\<lambda>n. ptr + (n << objBitsKO (KOCTE makeObject))) [0 .e. 2 ^ us - 1]) (ksPSpace s))) proof (prove)
goal:
No subgoals!