theory Retype_C

lemma ccorres_typ_region_bytes_dummy:
  "ccorresG rf_sr
     AnyGamma dc xfdc
     (invs' and ct_active' and sch_act_simple and
      pspace_no_overlap' ptr bits and
      (cnodes_retype_have_size S bits o gsCNodes)
      and K (bits < word_bits \<and> is_aligned ptr bits \<and> 2 \<le> bits
         \<and> 0 \<notin> {ptr..+2 ^ bits}
         \<and> {ptr ..+ 2 ^ bits} \<subseteq> S
         \<and> kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}))
     UNIV hs
     (return ())
     (global_htd_update (\<lambda>_. (typ_region_bytes ptr bits)))" apply (rule ccorres_from_vcg) apply (clarsimp simp: return_def) apply (simp add: rf_sr_def) apply vcg apply (clarsimp simp: cstate_relation_def Let_def) apply (frule typ_bytes_cpspace_relation_clift_tcb) apply (simp add: invs_pspace_aligned')+ apply (frule typ_bytes_cpspace_relation_clift_pte) apply (simp add: invs_pspace_aligned')+ apply (frule typ_bytes_cpspace_relation_clift_pde) apply (simp add: invs_pspace_aligned')+ apply (frule typ_bytes_cpspace_relation_clift_endpoint) apply (simp add: invs_pspace_aligned')+ apply (frule typ_bytes_cpspace_relation_clift_notification) apply (simp add: invs_pspace_aligned')+ apply (frule typ_bytes_cpspace_relation_clift_asid_pool) apply (simp add: invs_pspace_aligned')+ apply (frule typ_bytes_cpspace_relation_clift_cte) apply (simp add: invs_pspace_aligned')+ apply (frule typ_bytes_cpspace_relation_clift_userdata) apply (simp add: invs_pspace_aligned')+ apply (frule typ_bytes_cpspace_relation_clift_devicedata) apply (simp add: invs_pspace_aligned')+ apply (frule typ_bytes_cpspace_relation_clift_gptr[where ptr'="armKSGlobalPD_Ptr"]) apply (simp add: invs_pspace_aligned')+ apply (frule typ_bytes_cpspace_relation_clift_gptr[where ptr'="intStateIRQNode_array_Ptr"]) apply (simp add: invs_pspace_aligned')+ apply (simp add: carch_state_relation_def cmachine_state_relation_def) apply (simp add: cpspace_relation_def htd_safe_typ_region_bytes) apply (simp add: h_t_valid_clift_Some_iff) apply (simp add: hrs_htd_update gsCNodes_typ_region_bytes
                   cnodes_retype_have_size_mono[where T=S]
                   tcb_ctes_typ_region_bytes[OF _ _ invs_pspace_aligned']) apply (simp add: cmap_array_typ_region_bytes_triv
               invs_pspace_aligned' pdBits_def pageBits_def ptBits_def
               objBitsT_simps word_bits_def pteBits_def pdeBits_def
               zero_ranges_are_zero_typ_region_bytes) apply (rule htd_safe_typ_region_bytes, simp) apply blast done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorresG rf_sr AnyGamma dc xfdc (invs' and ct_active' and sch_act_simple and pspace_no_overlap' ptr bits and cnodes_retype_have_size S bits \<circ> gsCNodes and K (bits < word_bits \<and> is_aligned ptr bits \<and> 2 \<le> bits \<and> 0 \<notin> {ptr..+2 ^ bits} \<and> {ptr..+2 ^ bits} \<subseteq> S \<and> kernel_data_refs \<inter> {ptr..+2 ^ bits} = {})) UNIV hs (return ()) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes ptr bits (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits)))) proof (prove)
goal (1 subgoal):
 1. \<forall>\<sigma>. AnyGamma\<turnstile> {s. (invs' and ct_active' and sch_act_simple and pspace_no_overlap' ptr bits and cnodes_retype_have_size S bits \<circ> gsCNodes and K (bits < word_bits \<and> is_aligned ptr bits \<and> 2 \<le> bits \<and> 0 \<notin> {ptr..+2 ^ bits} \<and> {ptr..+2 ^ bits} \<subseteq> S \<and> kernel_data_refs \<inter> {ptr..+2 ^ bits} = {})) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes ptr bits (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits))) {s. \<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)} proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma>. AnyGamma\<turnstile> {s. invs' \<sigma> \<and> ct_active' \<sigma> \<and> sch_act_simple \<sigma> \<and> pspace_no_overlap' ptr bits \<sigma> \<and> cnodes_retype_have_size S bits (gsCNodes \<sigma>) \<and> bits < word_bits \<and> is_aligned ptr bits \<and> 2 \<le> bits \<and> 0 \<notin> {ptr..+2 ^ bits} \<and> {ptr..+2 ^ bits} \<subseteq> S \<and> kernel_data_refs \<inter> {ptr..+2 ^ bits} = {} \<and> (\<sigma>, s) \<in> rf_sr} Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes ptr bits (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits))) {s. (\<sigma>, s) \<in> rf_sr} proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma>. AnyGamma\<turnstile> {s. invs' \<sigma> \<and> ct_active' \<sigma> \<and> sch_act_simple \<sigma> \<and> pspace_no_overlap' ptr bits \<sigma> \<and> cnodes_retype_have_size S bits (gsCNodes \<sigma>) \<and> bits < word_bits \<and> is_aligned ptr bits \<and> 2 \<le> bits \<and> 0 \<notin> {ptr..+2 ^ bits} \<and> {ptr..+2 ^ bits} \<subseteq> S \<and> kernel_data_refs \<inter> {ptr..+2 ^ bits} = {} \<and> cstate_relation \<sigma> (globals s)} Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes ptr bits (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes ptr bits))) {s. cstate_relation \<sigma> (globals s)} proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> t_hrs phantom_machine_state ghost'state avail_reg ksNumCPUs ndks_boot active_irq rootserver ksCurDomain ksCurThread ksDomainTime ksIdleThread tlbLockCount armKSNextASID current_fault ksReadyQueues armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksDomScheduleIdx ksSchedulerAction current_extra_caps isFPUEnabledCached current_lookup_fault ksWorkUnitsCompleted current_syscall_error ksReadyQueuesL1Bitmap ksReadyQueuesL2Bitmap more. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cstate_relation \<sigma> \<lparr>t_hrs_' = t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr>\<rbrakk> \<Longrightarrow> htd_safe domain (hrs_htd t_hrs) \<and> htd_safe domain (typ_region_bytes ptr bits (hrs_htd t_hrs)) \<and> cstate_relation \<sigma> \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) t_hrs, phantom_machine_state_' = phantom_machine_state, ghost'state_' = ghost'state, avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = ksCurDomain, ksCurThread_' = ksCurThread, ksDomainTime_' = ksDomainTime, ksIdleThread_' = ksIdleThread, tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueues, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = ksDomScheduleIdx, ksSchedulerAction_' = ksSchedulerAction, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmap, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmap, \<dots> = more\<rparr> proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule\<rbrakk> \<Longrightarrow> htd_safe domain (typ_region_bytes ptr bits (hrs_htd (a, b))) \<and> cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> cready_queues_relation (clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) ksReadyQueuesa (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule\<rbrakk> \<Longrightarrow> is_aligned (?ptr48 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) (?bits48 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa)
 2. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule\<rbrakk> \<Longrightarrow> ?bits48 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa < word_bits
 3. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule\<rbrakk> \<Longrightarrow> pspace_aligned' \<sigma>
 4. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule\<rbrakk> \<Longrightarrow> pspace_no_overlap' (?ptr48 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) (?bits48 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) \<sigma>
 5. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes (?ptr48 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) (?bits48 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa)) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> htd_safe domain (typ_region_bytes ptr bits (hrs_htd (a, b))) \<and> cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> cready_queues_relation (clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) ksReadyQueuesa (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> htd_safe domain (typ_region_bytes ptr bits (hrs_htd (a, b))) \<and> cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> is_aligned (?ptr54 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) (?bits54 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa)
 2. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> ?bits54 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa < word_bits
 3. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> pspace_aligned' \<sigma>
 4. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> pspace_no_overlap' (?ptr54 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) (?bits54 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) \<sigma>
 5. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes (?ptr54 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) (?bits54 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa)) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> htd_safe domain (typ_region_bytes ptr bits (hrs_htd (a, b))) \<and> cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> htd_safe domain (typ_region_bytes ptr bits (hrs_htd (a, b))) \<and> cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> is_aligned (?ptr60 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) (?bits60 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa)
 2. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> ?bits60 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa < word_bits
 3. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> pspace_aligned' \<sigma>
 4. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> pspace_no_overlap' (?ptr60 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) (?bits60 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) \<sigma>
 5. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes (?ptr60 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) (?bits60 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa)) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> htd_safe domain (typ_region_bytes ptr bits (hrs_htd (a, b))) \<and> cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> htd_safe domain (typ_region_bytes ptr bits (hrs_htd (a, b))) \<and> cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> is_aligned (?ptr66 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) (?bits66 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa)
 2. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> ?bits66 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa < word_bits
 3. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> pspace_aligned' \<sigma>
 4. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> pspace_no_overlap' (?ptr66 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) (?bits66 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) \<sigma>
 5. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes (?ptr66 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) (?bits66 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa)) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> htd_safe domain (typ_region_bytes ptr bits (hrs_htd (a, b))) \<and> cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> htd_safe domain (typ_region_bytes ptr bits (hrs_htd (a, b))) \<and> cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> is_aligned (?ptr72 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) (?bits72 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa)
 2. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> ?bits72 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa < word_bits
 3. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> pspace_aligned' \<sigma>
 4. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> pspace_no_overlap' (?ptr72 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) (?bits72 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) \<sigma>
 5. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes (?ptr72 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) (?bits72 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa)) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> htd_safe domain (typ_region_bytes ptr bits (hrs_htd (a, b))) \<and> cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> htd_safe domain (typ_region_bytes ptr bits (hrs_htd (a, b))) \<and> cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> is_aligned (?ptr78 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) (?bits78 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa)
 2. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> ?bits78 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa < word_bits
 3. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> pspace_aligned' \<sigma>
 4. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> pspace_no_overlap' (?ptr78 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) (?bits78 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) \<sigma>
 5. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes (?ptr78 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) (?bits78 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa)) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> htd_safe domain (typ_region_bytes ptr bits (hrs_htd (a, b))) \<and> cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> htd_safe domain (typ_region_bytes ptr bits (hrs_htd (a, b))) \<and> cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> is_aligned (?ptr84 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) (?bits84 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa)
 2. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> ?bits84 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa < word_bits
 3. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> pspace_aligned' \<sigma>
 4. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> pspace_no_overlap' (?ptr84 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) (?bits84 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) \<sigma>
 5. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes (?ptr84 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) (?bits84 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa)) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> htd_safe domain (typ_region_bytes ptr bits (hrs_htd (a, b))) \<and> cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> htd_safe domain (typ_region_bytes ptr bits (hrs_htd (a, b))) \<and> cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> is_aligned (?ptr90 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) (?bits90 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa)
 2. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> ?bits90 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa < word_bits
 3. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> pspace_aligned' \<sigma>
 4. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> pspace_no_overlap' (?ptr90 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) (?bits90 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) \<sigma>
 5. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes (?ptr90 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) (?bits90 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa)) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> htd_safe domain (typ_region_bytes ptr bits (hrs_htd (a, b))) \<and> cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> htd_safe domain (typ_region_bytes ptr bits (hrs_htd (a, b))) \<and> cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> is_aligned (?ptr96 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) (?bits96 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa)
 2. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> ?bits96 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa < word_bits
 3. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> pspace_aligned' \<sigma>
 4. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> pspace_no_overlap' (?ptr96 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) (?bits96 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) \<sigma>
 5. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes (?ptr96 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) (?bits96 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa)) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> htd_safe domain (typ_region_bytes ptr bits (hrs_htd (a, b))) \<and> cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> htd_safe domain (typ_region_bytes ptr bits (hrs_htd (a, b))) \<and> cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> is_aligned (?ptr102 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) (?bits102 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa)
 2. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> ?bits102 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa < word_bits
 3. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> pspace_aligned' \<sigma>
 4. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> kernel_data_refs \<inter> {?ptr102 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa..+2 ^ ?bits102 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa} = {}
 5. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> ptr_span armKSGlobalPD_Ptr \<subseteq> kernel_data_refs
 6. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b)\<rbrakk> \<Longrightarrow> typ_uinfo_t TYPE(pde_C[4096]) \<noteq> typ_uinfo_t TYPE(8 word)
 7. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes (?ptr102 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) (?bits102 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa)) (a, b)) armKSGlobalPD_Ptr = clift (a, b) armKSGlobalPD_Ptr\<rbrakk> \<Longrightarrow> htd_safe domain (typ_region_bytes ptr bits (hrs_htd (a, b))) \<and> cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) armKSGlobalPD_Ptr = clift (a, b) armKSGlobalPD_Ptr\<rbrakk> \<Longrightarrow> htd_safe domain (typ_region_bytes ptr bits (hrs_htd (a, b))) \<and> cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) armKSGlobalPD_Ptr = clift (a, b) armKSGlobalPD_Ptr\<rbrakk> \<Longrightarrow> is_aligned (?ptr110 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) (?bits110 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa)
 2. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) armKSGlobalPD_Ptr = clift (a, b) armKSGlobalPD_Ptr\<rbrakk> \<Longrightarrow> ?bits110 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa < word_bits
 3. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) armKSGlobalPD_Ptr = clift (a, b) armKSGlobalPD_Ptr\<rbrakk> \<Longrightarrow> pspace_aligned' \<sigma>
 4. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) armKSGlobalPD_Ptr = clift (a, b) armKSGlobalPD_Ptr\<rbrakk> \<Longrightarrow> kernel_data_refs \<inter> {?ptr110 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa..+2 ^ ?bits110 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa} = {}
 5. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) armKSGlobalPD_Ptr = clift (a, b) armKSGlobalPD_Ptr\<rbrakk> \<Longrightarrow> ptr_span intStateIRQNode_array_Ptr \<subseteq> kernel_data_refs
 6. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) armKSGlobalPD_Ptr = clift (a, b) armKSGlobalPD_Ptr\<rbrakk> \<Longrightarrow> typ_uinfo_t TYPE(cte_C[256]) \<noteq> typ_uinfo_t TYPE(8 word)
 7. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) armKSGlobalPD_Ptr = clift (a, b) armKSGlobalPD_Ptr; clift (hrs_htd_update (typ_region_bytes (?ptr110 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa) (?bits110 \<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa)) (a, b)) intStateIRQNode_array_Ptr = clift (a, b) intStateIRQNode_array_Ptr\<rbrakk> \<Longrightarrow> htd_safe domain (typ_region_bytes ptr bits (hrs_htd (a, b))) \<and> cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> a b phantom_machine_state ba avail_reg ksNumCPUs ndks_boot active_irq rootserver tlbLockCount armKSNextASID current_fault ksReadyQueuesa armKSASIDTable rootserver_mem armKSHWASIDTable intStateIRQTable ksSchedulerActiona current_extra_caps isFPUEnabledCached current_lookup_fault current_syscall_error ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr>; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) armKSGlobalPD_Ptr = clift (a, b) armKSGlobalPD_Ptr; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) intStateIRQNode_array_Ptr = clift (a, b) intStateIRQNode_array_Ptr\<rbrakk> \<Longrightarrow> htd_safe domain (typ_region_bytes ptr bits (hrs_htd (a, b))) \<and> cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> carch_state_relation (ksArchState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cmachine_state_relation (ksMachineState \<sigma>) \<lparr>t_hrs_' = hrs_htd_update (typ_region_bytes ptr bits) (a, b), phantom_machine_state_' = phantom_machine_state, ghost'state_' = (gsUserPages \<sigma>, gsCNodes \<sigma>, ba), avail_reg_' = avail_reg, ksNumCPUs_' = ksNumCPUs, ndks_boot_' = ndks_boot, active_irq_' = active_irq, rootserver_' = rootserver, ksCurDomain_' = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>), ksCurThread_' = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>), ksDomainTime_' = ksDomainTime \<sigma>, ksIdleThread_' = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>), tlbLockCount_' = tlbLockCount, armKSNextASID_' = armKSNextASID, current_fault_' = current_fault, ksReadyQueues_' = ksReadyQueuesa, armKSASIDTable_' = armKSASIDTable, rootserver_mem_' = rootserver_mem, armKSHWASIDTable_' = armKSHWASIDTable, intStateIRQTable_' = intStateIRQTable, ksDomScheduleIdx_' = word_of_nat (ksDomScheduleIdx \<sigma>), ksSchedulerAction_' = ksSchedulerActiona, current_extra_caps_' = current_extra_caps, isFPUEnabledCached_' = isFPUEnabledCached, current_lookup_fault_' = current_lookup_fault, ksWorkUnitsCompleted_' = ksWorkUnitsCompleted \<sigma>, current_syscall_error_' = current_syscall_error, ksReadyQueuesL1Bitmap_' = ksReadyQueuesL1Bitmapa, ksReadyQueuesL2Bitmap_' = ksReadyQueuesL2Bitmapa\<rparr> \<and> cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> a b phantom_machine_state ba ksReadyQueuesa armKSASIDTablea armKSHWASIDTablea intStateIRQTable ksSchedulerActiona ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; armKSKernelVSpace (ksArchState \<sigma>) = armKSKernelVSpace_C \<and> array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) armKSHWASIDTablea \<and> array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) armKSASIDTablea \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m clift (a, b) \<circ>\<^sub>m pd_pointer_to_asid_slot) \<and> carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks phantom_machine_state \<and> irq_state (ksMachineState \<sigma>) = irq_state phantom_machine_state \<and> device_state (ksMachineState \<sigma>) = device_state phantom_machine_state \<and> exclusive_state (ksMachineState \<sigma>) = exclusive_state phantom_machine_state \<and> machine_state_rest (ksMachineState \<sigma>) = machine_state_rest phantom_machine_state; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) armKSGlobalPD_Ptr = clift (a, b) armKSGlobalPD_Ptr; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) intStateIRQNode_array_Ptr = clift (a, b) intStateIRQNode_array_Ptr\<rbrakk> \<Longrightarrow> htd_safe domain (typ_region_bytes ptr bits (hrs_htd (a, b))) \<and> cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> a b phantom_machine_state ba ksReadyQueuesa armKSASIDTablea armKSHWASIDTablea intStateIRQTable ksSchedulerActiona ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cmap_relation (ctes_of \<sigma>) (clift (a, b)) cte_Ptr ccte_relation \<and> cpspace_tcb_relation (ksPSpace \<sigma>) (a, b) \<and> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (clift (a, b)) ep_Ptr (cendpoint_relation (clift (a, b))) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (clift (a, b)) ntfn_Ptr (cnotification_relation (clift (a, b))) \<and> cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (clift (a, b)) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (clift (a, b)) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (clift (a, b)) ap_Ptr casid_pool_relation \<and> cpspace_user_data_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b) \<and> cpspace_device_data_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b) \<and> cpspace_pde_array_relation (ksPSpace \<sigma>) (a, b) \<and> cpspace_pte_array_relation (ksPSpace \<sigma>) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; armKSKernelVSpace (ksArchState \<sigma>) = armKSKernelVSpace_C \<and> array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) armKSHWASIDTablea \<and> array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) armKSASIDTablea \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m clift (a, b) \<circ>\<^sub>m pd_pointer_to_asid_slot) \<and> carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks phantom_machine_state \<and> irq_state (ksMachineState \<sigma>) = irq_state phantom_machine_state \<and> device_state (ksMachineState \<sigma>) = device_state phantom_machine_state \<and> exclusive_state (ksMachineState \<sigma>) = exclusive_state phantom_machine_state \<and> machine_state_rest (ksMachineState \<sigma>) = machine_state_rest phantom_machine_state; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); hrs_htd (a, b) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; hrs_htd (a, b) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) armKSGlobalPD_Ptr = clift (a, b) armKSGlobalPD_Ptr; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) intStateIRQNode_array_Ptr = clift (a, b) intStateIRQNode_array_Ptr\<rbrakk> \<Longrightarrow> htd_safe domain (typ_region_bytes ptr bits (hrs_htd (a, b))) \<and> cpspace_pde_array_relation (ksPSpace \<sigma>) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> cpspace_pte_array_relation (ksPSpace \<sigma>) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t intStateIRQNode_array_Ptr \<and> hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<Turnstile>\<^sub>t armKSGlobalPD_Ptr \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> a b phantom_machine_state ba ksReadyQueuesa armKSASIDTablea armKSHWASIDTablea intStateIRQTable ksSchedulerActiona ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cmap_relation (ctes_of \<sigma>) (clift (a, b)) cte_Ptr ccte_relation \<and> cpspace_tcb_relation (ksPSpace \<sigma>) (a, b) \<and> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (clift (a, b)) ep_Ptr (cendpoint_relation (clift (a, b))) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (clift (a, b)) ntfn_Ptr (cnotification_relation (clift (a, b))) \<and> cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (clift (a, b)) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (clift (a, b)) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (clift (a, b)) ap_Ptr casid_pool_relation \<and> cpspace_user_data_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b) \<and> cpspace_device_data_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b) \<and> cpspace_pde_array_relation (ksPSpace \<sigma>) (a, b) \<and> cpspace_pte_array_relation (ksPSpace \<sigma>) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; armKSKernelVSpace (ksArchState \<sigma>) = armKSKernelVSpace_C \<and> array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) armKSHWASIDTablea \<and> array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) armKSASIDTablea \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m clift (a, b) \<circ>\<^sub>m pd_pointer_to_asid_slot) \<and> carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks phantom_machine_state \<and> irq_state (ksMachineState \<sigma>) = irq_state phantom_machine_state \<and> device_state (ksMachineState \<sigma>) = device_state phantom_machine_state \<and> exclusive_state (ksMachineState \<sigma>) = exclusive_state phantom_machine_state \<and> machine_state_rest (ksMachineState \<sigma>) = machine_state_rest phantom_machine_state; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); \<exists>v. clift (a, b) intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; \<exists>v. clift (a, b) armKSGlobalPD_Ptr = Some v; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) armKSGlobalPD_Ptr = clift (a, b) armKSGlobalPD_Ptr; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) intStateIRQNode_array_Ptr = clift (a, b) intStateIRQNode_array_Ptr\<rbrakk> \<Longrightarrow> htd_safe domain (typ_region_bytes ptr bits (hrs_htd (a, b))) \<and> cpspace_pde_array_relation (ksPSpace \<sigma>) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> cpspace_pte_array_relation (ksPSpace \<sigma>) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes ptr bits) (a, b))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> a b phantom_machine_state ba ksReadyQueuesa armKSASIDTablea armKSHWASIDTablea intStateIRQTable ksSchedulerActiona ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < word_bits; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cmap_relation (ctes_of \<sigma>) (clift (a, b)) cte_Ptr ccte_relation \<and> cpspace_tcb_relation (ksPSpace \<sigma>) (a, b) \<and> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (clift (a, b)) ep_Ptr (cendpoint_relation (clift (a, b))) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (clift (a, b)) ntfn_Ptr (cnotification_relation (clift (a, b))) \<and> cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (clift (a, b)) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (clift (a, b)) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (clift (a, b)) ap_Ptr casid_pool_relation \<and> cpspace_user_data_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b) \<and> cpspace_device_data_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b) \<and> cpspace_pde_array_relation (ksPSpace \<sigma>) (a, b) \<and> cpspace_pte_array_relation (ksPSpace \<sigma>) (a, b); cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; armKSKernelVSpace (ksArchState \<sigma>) = armKSKernelVSpace_C \<and> array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) armKSHWASIDTablea \<and> array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) armKSASIDTablea \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m clift (a, b) \<circ>\<^sub>m pd_pointer_to_asid_slot) \<and> carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks phantom_machine_state \<and> irq_state (ksMachineState \<sigma>) = irq_state phantom_machine_state \<and> device_state (ksMachineState \<sigma>) = device_state phantom_machine_state \<and> exclusive_state (ksMachineState \<sigma>) = exclusive_state phantom_machine_state \<and> machine_state_rest (ksMachineState \<sigma>) = machine_state_rest phantom_machine_state; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); \<exists>v. clift (a, b) intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; \<exists>v. clift (a, b) armKSGlobalPD_Ptr = Some v; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) armKSGlobalPD_Ptr = clift (a, b) armKSGlobalPD_Ptr; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) intStateIRQNode_array_Ptr = clift (a, b) intStateIRQNode_array_Ptr\<rbrakk> \<Longrightarrow> htd_safe domain (typ_region_bytes ptr bits (hrs_htd (a, b))) \<and> carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (h_t_valid (typ_region_bytes ptr bits (hrs_htd (a, b))) c_guard) pd_Ptr \<and> carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (h_t_valid (typ_region_bytes ptr bits (hrs_htd (a, b))) c_guard) pt_Ptr \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) \<and> htd_safe domain (typ_region_bytes ptr bits (hrs_htd (a, b))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> a b phantom_machine_state ba ksReadyQueuesa armKSASIDTablea armKSHWASIDTablea intStateIRQTable ksSchedulerActiona ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < 32; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cmap_relation (ctes_of \<sigma>) (clift (a, b)) cte_Ptr ccte_relation \<and> cpspace_tcb_relation (ksPSpace \<sigma>) (a, b) \<and> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (clift (a, b)) ep_Ptr (cendpoint_relation (clift (a, b))) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (clift (a, b)) ntfn_Ptr (cnotification_relation (clift (a, b))) \<and> cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (clift (a, b)) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (clift (a, b)) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (clift (a, b)) ap_Ptr casid_pool_relation \<and> cpspace_user_data_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b) \<and> cpspace_device_data_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b) \<and> carray_map_relation 14 (map_to_pdes (ksPSpace \<sigma>)) (h_t_valid (hrs_htd (a, b)) c_guard) pd_Ptr \<and> carray_map_relation 10 (map_to_ptes (ksPSpace \<sigma>)) (h_t_valid (hrs_htd (a, b)) c_guard) pt_Ptr; cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; armKSKernelVSpace (ksArchState \<sigma>) = armKSKernelVSpace_C \<and> array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) armKSHWASIDTablea \<and> array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) armKSASIDTablea \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m clift (a, b) \<circ>\<^sub>m pd_pointer_to_asid_slot) \<and> carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks phantom_machine_state \<and> irq_state (ksMachineState \<sigma>) = irq_state phantom_machine_state \<and> device_state (ksMachineState \<sigma>) = device_state phantom_machine_state \<and> exclusive_state (ksMachineState \<sigma>) = exclusive_state phantom_machine_state \<and> machine_state_rest (ksMachineState \<sigma>) = machine_state_rest phantom_machine_state; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); \<exists>v. clift (a, b) intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; \<exists>v. clift (a, b) armKSGlobalPD_Ptr = Some v; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) armKSGlobalPD_Ptr = clift (a, b) armKSGlobalPD_Ptr; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) intStateIRQNode_array_Ptr = clift (a, b) intStateIRQNode_array_Ptr\<rbrakk> \<Longrightarrow> htd_safe domain (typ_region_bytes ptr bits (hrs_htd (a, b))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> a b phantom_machine_state ba ksReadyQueuesa armKSASIDTablea armKSHWASIDTablea intStateIRQTable ksSchedulerActiona ksReadyQueuesL1Bitmapa ksReadyQueuesL2Bitmapa. \<lbrakk>invs' \<sigma>; ct_active' \<sigma>; sch_act_simple \<sigma>; pspace_no_overlap' ptr bits \<sigma>; cnodes_retype_have_size S bits (gsCNodes \<sigma>); bits < 32; is_aligned ptr bits; 2 \<le> bits; 0 \<notin> {ptr..+2 ^ bits}; {ptr..+2 ^ bits} \<subseteq> S; kernel_data_refs \<inter> {ptr..+2 ^ bits} = {}; cmap_relation (ctes_of \<sigma>) (clift (a, b)) cte_Ptr ccte_relation \<and> cpspace_tcb_relation (ksPSpace \<sigma>) (a, b) \<and> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (clift (a, b)) ep_Ptr (cendpoint_relation (clift (a, b))) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (clift (a, b)) ntfn_Ptr (cnotification_relation (clift (a, b))) \<and> cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (clift (a, b)) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (clift (a, b)) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (clift (a, b)) ap_Ptr casid_pool_relation \<and> cpspace_user_data_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b) \<and> cpspace_device_data_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (a, b) \<and> carray_map_relation 14 (map_to_pdes (ksPSpace \<sigma>)) (h_t_valid (hrs_htd (a, b)) c_guard) pd_Ptr \<and> carray_map_relation 10 (map_to_ptes (ksPSpace \<sigma>)) (h_t_valid (hrs_htd (a, b)) c_guard) pt_Ptr; cready_queues_relation (clift (a, b)) ksReadyQueuesa (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (a, b); cbitmap_L1_relation ksReadyQueuesL1Bitmapa (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation ksReadyQueuesL2Bitmapa (ksReadyQueuesL2Bitmap \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr intStateIRQTable; cscheduler_action_relation (ksSchedulerAction \<sigma>) ksSchedulerActiona; armKSKernelVSpace (ksArchState \<sigma>) = armKSKernelVSpace_C \<and> array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) armKSHWASIDTablea \<and> array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) armKSASIDTablea \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m clift (a, b) \<circ>\<^sub>m pd_pointer_to_asid_slot) \<and> carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks phantom_machine_state \<and> irq_state (ksMachineState \<sigma>) = irq_state phantom_machine_state \<and> device_state (ksMachineState \<sigma>) = device_state phantom_machine_state \<and> exclusive_state (ksMachineState \<sigma>) = exclusive_state phantom_machine_state \<and> machine_state_rest (ksMachineState \<sigma>) = machine_state_rest phantom_machine_state; cvariable_array_map_relation (gsCNodes \<sigma>) ((^) 2) cte_Ptr (hrs_htd (a, b)); cvariable_array_map_relation (map_to_tcbs (ksPSpace \<sigma>)) (\<lambda>x. 5) cte_Ptr (hrs_htd (a, b)); ghost_size_rel (gsUserPages \<sigma>, gsCNodes \<sigma>, ba) (gsMaxObjectSize \<sigma>); \<exists>v. clift (a, b) intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; \<exists>v. clift (a, b) armKSGlobalPD_Ptr = Some v; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (a, b)); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) = clift (a, b); clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) armKSGlobalPD_Ptr = clift (a, b) armKSGlobalPD_Ptr; clift (hrs_htd_update (typ_region_bytes ptr bits) (a, b)) intStateIRQNode_array_Ptr = clift (a, b) intStateIRQNode_array_Ptr\<rbrakk> \<Longrightarrow> {ptr..+2 ^ bits} \<subseteq> domain proof (prove)
goal:
No subgoals!